Understanding REvil: REvil Threat Actors May Have Returned (Updated)
Summary: Unit 42 reports that REvil, the ransomware group behind an $11 million payment from a U.S. meatpacking subsidiary and the Kaseya VSA attack, went offline in October 2021 amid multi-government pursuit and arrests, then saw its old leak site come back online on April 20, 2022, redirecting to a new Onion address with an RSS feed and a 'Join Us' affiliate recruiting section. A REvil/Sodinokibi sample compiled April 26 and found on VirusTotal April 29 carried pointers to the new leak and payment sites, a $1.5 million ransom demand, and an accs field naming organizations in Taiwan and Israel, though the sample only renamed files with a random extension rather than encrypting them.
Bottom line: Unit 42 states it is not clear whether the original actors are behind the revival or this is REvil under new management, and other cybercriminals suspect law enforcement is involved - so a victim weighing a $1.5 million demand, which doubles if unpaid within the deadline, cannot assume the party on the other end is who the brand says it is.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026