From news.softpedia.com
According to four people familiar with the attack, who were not allowed to speak publicly about it, the cyberattack against JBS SA was carried out by a known Russian-linked hacking group, as Bloomberg notes. The cyber gang is known as REvil or Sodinokibi.
While it is not known if all of REvil’s hackers are based in Russia, the public face of the group, a user of the dark web cybercrime forum XSS who goes by the name Unknown, writes only in Russian. When victims refuse to engage in ransomware discussions, REvil usually names them on a Darkweb site called Happy Blog. REvil has not yet published a blog post about JBS.