Is ‘REvil’ the New Gand Crab Ransomware?
Summary: Krebs on Security reports that the GandCrab ransomware-as-a-service team, which claimed over $2 billion in extortion payments, announced its retirement on May 31 but appears to have regrouped behind a more private RaaS program called REvil, Sodin, or Sodinokibi. In late April, Cisco Talos spotted Sodinokibi deploying GandCrab, and in early May an actor using the nickname "Unknown" deposited more than $130,000 in virtual currencies on two cybercrime forums to recruit five affiliates at a 60 to 70 percent cut.
Key Takeaway: A group that allegedly extracted more than $2 billion did not walk away; it narrowed its affiliate roster to five and went quiet, which means the operators behind the most prolific ransomware of the past year are still active and harder to see.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026