New REvil Samples Indicate Ransomware Gang is Back After Months of Inactivity

The notorious ransomware operation recognized as REvil (aka Sodin or Sodinokibi) has resumed following 6 months of inactivity, an analysis of new ransomware samples has unveiled.

“Analysis of these samples signifies that the developer has accessibility to REvil’s source code, reinforcing the probability that the threat group has reemerged,” scientists from Secureworks Counter Menace Unit (CTU) claimed in a report released Monday.

“The identification of a number of samples with different modifications in these types of a brief period of time and the lack of an formal new variation indicates that REvil is less than large lively advancement when again.”

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

REvil, shorter for Ransomware Evil, is a ransomware-as-a-company (RaaS) scheme and attributed to a Russia-primarily based/talking group regarded as Gold Southfield, arising just as GandCrab exercise declined and the latter introduced their retirement.

It really is also one of the earliest teams to undertake the double extortion scheme in which stolen data from intrusions is utilised to make additional leverage and compel victims into paying out up.

Operational considering the fact that 2019, the ransomware group produced headlines previous year for their significant-profile attacks on JBS and Kaseya, prompting the gang to formally shut shop in Oct 2021 soon after a legislation enforcement motion hijacked its server infrastructure.

Previously this January, a number of customers belonging to the cybercrime syndicate ended up arrested by Russia’s Federal Security Provider (FSB) in the wake of raids carried out at 25 various locations in the state.

The evident resurgence comes as REvil’s data leak web site in the TOR network commenced redirecting to a new host on April 20, with cybersecurity business Avast disclosing a week later that it experienced blocked a ransomware sample in the wild “that seems like a new Sodinokibi / REvil variant.”

Even though the sample in question was uncovered to not encrypt information and only add a random extension, Secureworks has chalked it up to a programming mistake released in the functionality that renames data files that are becoming encrypted.

On best of that, the new samples dissected by the cybersecurity firm — which carry a timestamp of March 11, 2022 — include noteworthy modifications to the resource code that established it apart from a further REvil artifact dated October 2021.

This involves updates to its string decryption logic, the configuration storage location, and the hard-coded public keys. Also revised are the Tor domains exhibited in the ransom take note, referencing the exact web pages that went live very last thirty day period –

• REvil leak website: blogxxu75w63ujqarv476otld7cyjkq4yoswzt4ijadkjwvg3vrvd5yd[.]onion
• REvil ransom payment web site: landxxeaf2hoyl2jvcwuazypt6imcsbmhb7kx3x33yhparvtmkatpaad[.]onion

REvil’s revival is also likely tied to Russia’s ongoing invasion of Ukraine, pursuing which the U.S. backed out of a proposed joint cooperation amongst the two nations around the world to safeguard critical infrastructure.

If everything, the progress is however one more sign that ransomware actors disband only to regroup and rebrand beneath a diverse title and choose up right from exactly where they still left off, underscoring the problems in totally rooting out cybercriminal groups.

Observed this post exciting? Follow THN on Fb, Twitter  and LinkedIn to read additional unique content material we article.