Everything to know about REvil, the group behind a big ransomware spree

The Kaseya attack, which started last Friday, hit a number of companies and organizations, including Sweden’s largest supermarket chain Coop and schools in New Zealand. To gain access to the victims, the hackers exploited a bug in the IT management software of Kaseya.

In June, the FBI said REvil was behind the massive cyber attack that shut down the operations of JBS the world’s biggest meat supplier. Although JBS said it was able to regain control of its computer systems, it paid a $11 million ransom to “mitigate any unforeseen issues related to the attack and ensure no data was exfiltrated.”

Here’s what you need to know about the notorious hacking group and its ransomware attacks.

What is REvil?

REvil’s name is an amalgam of “ransomware” and “evil,” said Satnam Narang, a staff research engineer for the security firm Tenable. The group is also known as Sodinokibi, and security researchers have previously named the organization’s family of malware that encrypts, or scrambles data REvil/Sodinokibi, or REvil.Sodinokibi.

Security researchers have linked the creators of the REvil/Sodinokibi malware to the authors of the GandCrab ransomware, which was first noticed in 2018. Hackers affiliated with GandCrab targeted healthcare firms, including the medical service billing provider Doctor’s Management Service.

In 2019, members of this GandCrab said they would retire and bragged about collecting $2 billion in ransom payments after just one year. A year later, the Minister of Internal Affairs of Belarus said it had arrested a hacker with ties to GandCrab.

Tony Cook, ransomware negotiator and head of threat intelligence at GuidePoint Security, said REvil appears to be inspired by GandCrab in that the two groups use similar tool and hacking techniques. That said, with the number of similar ransomware groups, it’s hard to determine which hacking group is responsible for specific attacks.

Narang noted that the GandCrab group targeted managed service providers, which operate IT systems on behalf of other companies, during its final days. This gives credence to the notion that former GandCrab members are now with REvil.

What does REvil do?

REvil acts a business that sells hacking technology and other tools to third-party hackers. REvil members have created online infrastructure on the dark web, a part of the Internet that search engines like Google don’t track, for other hackers to post stolen documents and collect ransomware payments from victims, Narang said. In exchange for using REvil’s services and malware, REvil, like similar groups, takes a roughly 20% cut of any ransomware payments while its affiliate hackers keep the other 80%, he added.

Other hacking groups that operate similar ransomware-as-a-service include Conti and Ryuk, Narang said.

What does REvil want?

Unlike nation-state hackers, REvil is purely financially motivated, said Jack Cable, a security architect at cybersecurity consulting firm Krebs Stamos Group.

Cable contacted REvil through the dark web to see if it would sell him a so-called universal decryptor key, which would unlock and unscramble infected computers. He was surprised when the group offered him the tool for $50 million instead of the initial asking price of $70 million, which led him to speculate that it may be having trouble collecting payments.

Cable was also surprised that REvil seemed willing to accept Bitcoin as a payment instead of the cryptocurrency Monero, which is considered to be more difficult to trace.

Hacking groups that are financially motivated, he said, can be more dangerous than nation-state hacking groups because they are more willing to “shut down hospitals.” Nation-state hacking groups operate by “unwritten rules and norms” that typically mean they avoid engineering hacks that could kill people, like shutting down a hospital, he explained. 

What else has REvil hacked?

Besides Kaseya and JBS, REvil has been linked to high-profile ransomware attacks, including against Quanta, a Taiwanese company that sells data center gear to Apple. REvil said it was able to steal sensitive data from Apple like computer designs and demanded a $50 million ransom. But as tech publication MacRumors reported in April, REvil “mysteriously removed all references related to the extortion attempt from its dark web blog.” It’s unclear whether Apple or Quanta paid the ransom. 

REvil also took credit for hacking New York law firm Grubman, Shire, Meiselas & Sacks, claiming to have obtained documents related to former President Donald Trump. But some security researchers suspected the group was bluffing, and the Trump administration designated REvil as a terrorist group.  

How can companies prevent ransomware attacks?

Companies should back up all of their important data offline so they can restore their IT systems after being attacked, without paying a ransom. Companies also should provide cybersecurity training to their employees.

“The CEO of every business has to be preparing for ransomware,” Cable said. “They need to think about a cybersecurity strategy.”