REvil operations have once again ceased following a recent compromise of their TOR sites. News of this compromise was dropped by a high ranking REvil member who posted on a deep/dark web forum stating, “The server was compromised and they were looking for me. To be precise, they deleted the path to my hidden service…Good luck everyone, I’m off.” Few actors of the group have access to the hidden service. Some actors, however, were notified when a series of private and public key pairings were seen initializing the hidden service. Private keys are only known to the site administrators but once their sites were hijacked by a third party, the attackers had access to those private keys, spooking numerous REvil members into hiding. The decision to terminate website operations was made by REvil’s biggest public figure “UNKN”, whom is one of the key actors since the threat group first became known. At this time, it is not known who compromised the REvil servers; however, speculation leads to the possibility of law enforcement seizure following several massive attacks from the group. CTAPT is monitoring the movements of the threat group as well as the evolving situation and will send out additional updates accordingly.