Powered by MOMENTUM MEDIA
cyber daily logo

Breaking news and updates daily. Subscribe to our Newsletter

Breaking news and updates daily. Subscribe to our Newsletter X facebook linkedin Instagram Instagram

Details of REvil ransomware gang’s attempt to bribe Tesla employee revealed in trial

The trial of eight members of the ransomware gang linked to the 2021 Colonial Pipeline hack may not reach a satisfying verdict, however.

user icon David Hollingworth
Wed, 10 Jul 2024
Details of REvil ransomware gang’s attempt to bribe Tesla employee revealed in trial
expand image

Given what we know of Russia’s backing of numerous hacking groups, the idea of Russian criminal justice actually applying to one of its own may seem far-fetched, but the trial of eight alleged members of the now defunct REvil ransomware gang is finally nearing its end in St Petersburg.

However, while the trial has, in the words of Russian media outlet Izvestia, fallen “victim to geopolitics” since Russia’s invasion of Ukraine and the United States’ decision to no longer assist in the case, some interesting facts have emerged.

Most notably, an attempt to bribe a Tesla employee into planting malware at a Tesla facility.

============
============

According to Izvestia’s reporting – which should be taken somewhat with a grain of salt; the outlet is banned in the European Union as a propaganda organ for the Russian government – a witness in the case outlined a plan that formed in 2020, about a year before it assisted the DarkSide ransomware gang in its attack on Colonial Pipeline. It was the Colonial Pipeline attack that eventually led to an international operation leading to the gang’s arrest.

Yegor Kryuchkov – who was arrested by the FBI soon after – testified that a figure close to REvil’s leadership, Alexey Skorobogatov, asked him if he had any friends at large companies outside of Russia. Kryuchkov said he knew a Tesla engineer, and the plot was formed.

Skorobogatov convinced Kryuchkov to fly to the US – paid for by Skorobogatov – and offer his friend, Dmitry Volkov, a US$500,000 bribe to introduce ransomware into Tesla’s systems. The plan was to then stage a distributed denial-of-service (DDoS) attack to cover the exfiltration of data. Kryuchkov said at the time that the gang had carried out many such insider attacks.

In his recent testimony, Kryuchkov said that he asked the Tesla engineer to either introduce the malware himself or simply open an email that contained a Trojan that would then deploy the software.

Volkov, however, not only asked for double the money on offer – US$1 million – but also reported the plan to the FBI, which subsequently made an arrest. Kryuchkov spent 10 months in prison before being deported to Russia to appear in the Revil case.

Skorobogatov is not on trial.

Disappointingly, it appears that the case may end up going nowhere without US assistance, as without evidence, the Colonial Pipeline hack and other ransomware crimes are not before the court. Rather, the eight REvil members are charged with “illegal circulation of payment means committed by an organised group”, which relates to earlier carding scams – bank card theft, in other words.

And even then, there’s a lack of evidence thanks to the US stance on sharing evidence, likely associated with Russia’s decision to try the eight in a military court since one of the alleged hackers was serving in the military at the time of their crimes.

Given many REvil operators ended up working with Wagner’s Yevgeny Prigozhin and were moved into other government positions after Prigozhin’s demise, it’s not unlikely that the same could happen should the eight hackers go free.

David Hollingworth

David Hollingworth

David Hollingworth has been writing about technology for over 20 years, and has worked for a range of print and online titles in his career. He is enjoying getting to grips with cyber security, especially when it lets him talk about Lego.

newsletter
cyber daily subscribe
Be the first to hear the latest developments in the cyber industry.