{"id":2295,"date":"2021-05-17T11:48:38","date_gmt":"2021-05-17T09:48:38","guid":{"rendered":"https:\/\/fortgale.com\/news\/?p=2295"},"modified":"2026-06-08T22:52:43","modified_gmt":"2026-06-08T22:52:43","slug":"revil-ransomware-linux-variant","status":"publish","type":"post","link":"https:\/\/fortgale.com\/blog\/emerging-threats\/revil-ransomware-linux-variant\/","title":{"rendered":"REvil Ransomware: Linux server encryption variant available"},"content":{"rendered":"\n

One of the leading groups in the extortion attack<\/strong> business is the group developing the REvil Ransomware<\/strong>, known by the names Gold Southfield<\/strong><\/a> (GS<\/strong>), Pinchy Spider.
This group has rapidly evolved and organized to attack organizations through multiple methods, including system encryption (Ransomware<\/strong>), exfiltration of corporate data (Double-Extortion<\/strong>), and leasing its entire infrastructure to affiliates (Ransomware-as-a-Service<\/strong>).<\/p>\n\n\n\n

To date, the REvil ransomware was available to its affiliates exclusively for Microsoft Windows<\/strong> systems. Recently, availability of the version for Linux systems<\/strong> and NAS<\/strong> has been published on several underground forums:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Once GS<\/strong> focuses on a potential victim, the attack transitions to a more operationally complex phase executed by Ransomware program affiliates who navigate through compromised networks to locate data, exfiltrate it, and initiate ransomware attacks across as many devices as possible. Our Managed Detection and Response<\/a> operations have tracked this progression across multiple victim environments.<\/p>\n\n\n\n

\n

THREAT ACTOR: <\/strong>
Gold Southfield<\/strong><\/span><\/span><\/h2>\n<\/div><\/div>\n\n\n\n


According to X-Force data from 2020, the estimated total victim count stands at approximately 250 organizations. Conservative estimates place total ransom revenue from Sodinokibi at 123 million USD in 2020.<\/p>\n

Of 19 estimated victim organizations with total annual revenue of 1 billion USD or more, at least 15 have likely paid multimillion-dollar ransoms to this group.<\/p>\n

REvil operators have actively recruited additional affiliates. One method to attract new members to collaborate is to display their wealth by depositing 1 million USD in a Russian-language underground forum, assuring members that the operation is trustworthy and that those who join will be compensated.<\/p>\n

The types of skills required to access the affiliate program:<\/p>\n

\n

“Groups that already possess experience and expertise in penetration testing, working with MSF (alias Metasploit Framework) \/ CS (alias Cobalt Strike) \/ Koadic (a Windows post-exploitation framework and penetration testing tool), NAS \/ Tape (corporate data storage and archival), Hyper-V and analogues of the listed software programs …<\/em> “<\/p>\n<\/blockquote>\n","protected":false},"excerpt":{"rendered":"

REvil ransomware Linux build: ESXi\/Linux server encryption capability, deployment patterns observed and detection considerations for hybrid environments.<\/p>\n","protected":false},"author":1,"featured_media":2615,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[3228,130,156,3227,204,3134,240,270,295,327],"class_list":["post-2295","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-emerging-threats","tag-cross-platform-threats","tag-esxi","tag-gold-southfield","tag-hypervisor-targeting","tag-linux","tag-linux-ransomware","tag-nas","tag-pinchy-spider","tag-revil","tag-sodinokibi"],"_links":{"self":[{"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/posts\/2295","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/comments?post=2295"}],"version-history":[{"count":1,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/posts\/2295\/revisions"}],"predecessor-version":[{"id":9879,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/posts\/2295\/revisions\/9879"}],"wp:attachment":[{"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/media?parent=2295"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/categories?post=2295"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/tags?post=2295"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}