Backdoor inside REvil Ransomware
Backdoor discovered inside the REvil ransomware affiliate build: developer access to victim payments, affiliate-trust implications and underground reactions.
Tag
revil
Read the analysis
REvil/Sodinokibi Ransomware decryptor
Universal decryptor released for REvil/Sodinokibi: scope of recovery, conditions of usability and operational guidance for victims with encrypted backups.
REvil infrastructure back online
REvil ransomware infrastructure resurfaces after the July 2021 shutdown: leak site, payment portal status and tracking signals for the rebuilt operation.
Ransomware Evolution and Group Reorganization
Over the past year, ransomware and cyberattacks have experienced exponential growth. In 2020, the FBI reported a 400% increase in cyberattacks—incidents that have not only become more frequent but also more precise, accurate, and methodical. Below is an examination of the reorganization of several prominent criminal groups. BlackMatter A new ransomware gang named BlackMatter is … Read more
REvil Kaseya — sample analysis
Technical analysis of the REvil ransomware sample dropped through the Kaseya VSA supply-chain compromise: code structure, encryption logic, and supply-chain risk lessons.
Business Ransomware: ongoing reorganisation
Ransomware ecosystem reorganisation following law-enforcement pressure: rebrandings, splinter groups, affiliate movement and intelligence priorities for defenders.
Protected: DarkSide — The group and its evolution
There is no excerpt because this is a protected post.
REvil Ransomware Operator: A time zone analysis
In April 2021, an unidentified Gold Southfield operator carried out a Ransomware attack against a European company. The initial access is performed by Gold Cabin, an access broker, that deploys IceID (Bokbot), a Remote Access Tool (RAT) malware[link]. Once inside the company, the access broker passes privileges to the main operator who deploys the REvil ransomware. This threat actor … Read more
REvil Ransomware: Linux server encryption variant available
REvil ransomware Linux build: ESXi/Linux server encryption capability, deployment patterns observed and detection considerations for hybrid environments.
