The REvil group returned to active activity

[Teacher]

On September 9, a new version of the REvil ransomware was uploaded to VirusTotal, compiled on September 4.

The extortionist group REvil, which disappeared from sight a few months ago, has returned to activity and is attacking companies again. The first signs of the group's activity appeared last week, when the REvil portal on the darknet went back online.

REvil entered the ransomware scene in 2019 and became widely known for attacks on a number of large companies, including JBS and Kaseya, from which they demanded multimillion-dollar ransoms to recover encrypted data.

The group turned off its web infrastructure after a massive attack on the American company Kaseya, which affected thousands of enterprises in several countries around the world. The ransomware demanded $ 50 million from the company for a universal decryptor. In late July, Kaseya announced that it had received the decryption key from a "third party".

For almost two months, nothing was heard about the group, but on September 7, payment sat and the REvil leak site returned online with the same list of victims, and on September 9, a new version of the REvil ransomware was uploaded to VirusTotal, compiled on September 4.

According to a message on one of the hacker forums, the group has a new public representative instead of the administrator of REvil, who uses the pseudonym Unknown (or UNKN). According to a new spokesman known as REvil, the group has temporarily ceased operations due to suspicions that Unknown has been arrested and the servers have been compromised. He also said that the universal decryptor obtained by Kaseya simply "leaked" due to an error during key generation, and not after a law enforcement operation, as previously thought.

At this point, it is unclear exactly how REvil is doing. According to one of the operators, the group simply went "on vacation." Be that as it may, REvil has returned to activity again, which means that we need to wait for new attacks.

 

[Teacher]

REvil partners confirmed the fact of deception by the group
One of the members of the Russian-language hacker forum Exploit renewed claims against REvil from May of this year.

The partners of the operators of the ransomware REvil at a Russian-language hacker forum demanded that the group pay for the stolen ransom share. Security experts from Advanced Intelligence discovered a backdoor that allegedly allowed operators of the REvil ransomware to intercept chats of their partners and victims and receive the full amount of the ransom paid.

When a ransomware partner breaks into the network and tries to provide persistence on the system, REvil operators transmit the payload to the partner to infect the network and encrypt the data. If the victim pays the ransom, the partner group gets 70% of that amount for doing all the work of compromising the network, stealing data, and encrypting. REvil members receive the remaining 30% in exchange for providing ransomware that partners use to take control of victims' data and systems.
But when negotiations unexpectedly mysteriously fail and the partners are left with nothing, they become suspicious and turn to the underground version of the judges.
According to the resource Threatpost, one of the participants of the Russian-speaking hacker forum Exploit used the results of the Advanced Intelligence report to renew the claims brought against the REvil group in May this year. The hacker reiterated the statement from May 2021 on the Exploit forum, confirming Adv Intel's assumption that the REvil operators actually created a backdoor that allowed them to interrupt the ransom negotiations between victims and partners, launch a double chat and exclude partners from the deal, appropriating the entire ransom.

According to experts, not only the offended partner confirmed the deception on the part of REvil. A representative of the LockBit group also joined the discussion and spoke about the former partners of REvil, deceived by the ransomware.

According to experts, confirmation of the deception of REvil partners will lead to the group being avoided in the cybercriminal community, and its ability to hire new partners will be greatly weakened.