REvil, a Russian-language ransomware gang, has suspended operations for the second time in recent months, this time because the group itself was compromised.

REvil’s leaks blog, called the Happy Blog, went offline on Oct. 17. On the same day, a REvil member announced that the group was shutting down on a Russian-language hacking forum because its domain had been hijacked. The REvil member said someone had used the private Tor keys of the group’s former spokesperson, “Unknown,” to access REvil’s domain.