Notorious Russian Ransomware Group 'REvil' Has Reappeared

The infamous criminal ransomware group behind the JBS SA cyberattack has returned to the dark web after vanishing this summer. From a report: "REvil," short for "Ransomware-Evil," is among the most prolific cyber gangs to hold data for ransom. The group operates from Russia, according to cybersecurity firms and the U.S. government, and is accused of leading a flurry of attacks this year against companies and organizations, including JBS. The giant Brazilian meat supplier eventually paid an $11 million ransom. REvil runs a website called the "Happy Blog," where it publishes samples of data stolen before locking companies out of their own networks. The attackers then try to persuade targets to pay for a digital key to restore network access.

A portal REvil uses to negotiate with victims also came back online on Tuesday, according to Adam Meyers, vice president of intelligence at cybersecurity firm CrowdStrike, although the cybergang hasn't posted any new victims. Meyers says it appears the site was restored by the same actors running the portal before it went offline in June without explanation. "I would think this was a cool-off period," he said. "There was a lot of heat back in June/July. Maybe they rebuilt some infrastructure and invested in better operational security."

Scooby

[Tablizer]

Russia revils reappear? Rhat's riricurous!

Re:

[rudy_wayne]

And today is September 8, just like I predicted it would be.

Do as we do.

[Ostracus]

Maybe they rebuilt some infrastructure and invested in better operational security.

Better than their victims.

REvil ransomware explained

[takionya]

REvil ransomware explained: A widespread extortion operation [csoonline.com]

JBS

[DarkOx]

Had to google quick - forgot JBS was the meat packing company. I first saw JBS and assume John Birch Society; and thought - Russian hakers are targeting Joh Birch, its like 1980 again!

Only thing surprising about this is...

[EvilSS]

...that they kept the name. I expected them to rebrand. Oh well. Unfortunately there is too much money in it for them and since Russia seems to give absolutely zero fucks about these groups operating on Russian soil, the members of these groups are not going to just fold up shop and walk away.

Re:

[ayesnymous]

I would have thought they'd try a name such as RGood.