REvil Ransomware Back in Full Attack Mode and Leaking Data

Share post:

REvil Ransomware gang has returned to attack new victims, while also posting stolen files on a data leak website.

Their reemergence comes almost two months after shutting down their infrastructure following a massive attack in which the gang exploited a zero-day vulnerability in the Kaseya VSA remote management platform.

While the gang’s Tor payment / negotiation and data leak page suddenly made accessible on September 7, evidence of new attacks first appeared on September 9, when an annonymous user reported a new REvil Ransomware profile compiled on September 4 on VirusTotal, and screenshots of stolen data from a new victim on their data leak page a few hours earlier.

A new representative named ‘REvil’ has also emerged, explaining in a hacker forum what led to the gang’s short-term shutdown. The user also suggested that the former REvil representative, known as ‘Unknown’ or ‘UNKN’ and posted on behalf of the group, had been replaced.

For more information, read the original story in Bleeping Computer.

Featured Tech Jobs

SUBSCRIBE NOW

Related articles

Russian threat actor expanding its target list, warns Five Eyes report

APT29 is increasingly going after cloud services in mo

Canada’s privacy watchdog investigating hack at Global Affairs

Inquiry will look into adequacy of data safeguards at the federal

Sidebar: The powerful Digital Safety Commission

A look at the powers of the proposed five-person body charged with overseeing the Online

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways