Bottom line: The REvil group's claim is the first public acknowledgment of a ransomware attack on US government agencies.
What's happening: REvil is a Russia-based ransomware group that has claimed responsibility for the attack, which occurred between March 9 and March 11, 2021, on US government agencies, including the US Department of State, the US Department of Homeland Security, and the US Department of the Treasury. The group posted a message on its dark web forum stating that it had infected over 18,000 devices in the US government.
What to do: Security leaders should review their incident response plans to ensure they are prepared for similar attacks and consider implementing additional security measures, such as multi-factor authentication and regular software updates.