Qualified triples from the transcripts. Origin, speaker, and evidence stay attached. These are not independently verified facts.
GSM Law ransomware attack INVOLVES REvil
REvil allegedly accessed GSM Law and stole hundreds of gigabytes of data.
Uncertain Confidence 94% · Will EP 126 Details
“REvil managed to get into GSM Law and steal – allegedly steal hundreds of gigabytes of data from them”
Kaseya ransomware attack INVOLVES REvil
The Kaseya ransomware attack involved REvil ransomware.
Explicit Confidence 99% · Will EP 126 Details
“The Kaseya attack popped up and it said – this is what REvil wrote”
Travelex ransomware attack INVOLVES REvil
Will says Travelex was hit by REvil ransomware, based on a report he had read.
Attributed Confidence 95% · Will EP 126 Details
“Travelex had been hit by REvil ransomware”
JBS ransomware attack INVOLVES REvil
The episode presents the JBS ransomware attack as part of the ransomware activity discussed around REvil, but does not explicitly identify the malware as REvil in the quoted passage.
Uncertain Confidence 52% · Will EP 126 Details
“That was a huge international incident. Everyone said that was the one step too far.”
Texas government REvil attack INVOLVES REvil
The Texas government incident involved deployment of REvil through a managed service provider.
Explicit Confidence 99% · Will EP 126 Details
“one of the REvil affiliates managed to get into the Texas government and deploy”
Will MEMBER_OF Equinix Threat Analysis Center
Will says he works for the Equinix Threat Analysis Center as a threat intelligence analyst.
Explicit Confidence 99% · Will EP 126 Details
“I work for the Equinix Threat Analysis Center. I’m a threat intelligence analyst.”
REvil USES PowerShell
REvil attackers used PowerShell code on compromised servers after exploiting a vulnerability.
Explicit Confidence 96% · Will EP 126 Details
“launch some power shell codes on the server”
REvil USES double extortion
REvil used double extortion by encrypting files and leaking stolen data.
Explicit Confidence 99% · Will EP 126 Details
“double extortion, was encrypting your files and then leaking your data”
REvil affiliates used OSINT to choose targets before seeking access to their networks.
Explicit Confidence 98% · Will EP 126 Details
“It would start with the OSINT, it would start with picking a target”
REvil leaked stolen victim data to a Tor website described as a wall of shame.
Explicit Confidence 98% · Will EP 126 Details
“leaking it with – to a Tor website”
GandCrab USES initial access broker
GandCrab obtained access to companies through the underground initial-access market.
Explicit Direction flagged Confidence 95% · Jack Rhysider EP 126 Details
“this is how the GandCrab group would infect companies; they’d buy access into a company”
REvil USES Distributed denial-of-service
REvil added a further extortion tactic by DDoSing victims or their partners until negotiations began.
Explicit Confidence 99% · Will EP 126 Details
“they would now begin to DDoS you or your partners”
REvil USES scheduled task
REvil commonly deployed ransomware by scheduling a task on computers across the network using domain-administrator credentials.
Explicit Confidence 99% · Will EP 126 Details
“the common way they deploy it is via scheduling a task on all the computers in the network”
After exploiting a public-facing server vulnerability, REvil attackers deployed a web shell to establish an initial foothold.
Explicit Confidence 98% · Will EP 126 Details
“they would deploy a web shell or some – launch some power shell codes on the server, establish that initial foothold”
GandCrab USES big game hunting
Will says the GandCrab group pioneered big game hunting, meaning attacks focused on large, wealthy companies.
Explicit Confidence 96% · Will EP 126 Details
“GandCrab is – it was basically the group that pioneered what we call big game hunting.”
REvil USES Remote Desktop Protocol
Will says attackers could buy RDP credentials as an entry point for REvil attacks.
Explicit Confidence 97% · Will EP 126 Details
“you can buy RDP credentials”
REvil USES lateral movement
After gaining an initial foothold, REvil attackers performed reconnaissance and spread through the network.
Explicit Confidence 98% · Will EP 126 Details
“do some reconnaissance inside the network and then spread around as best they can”
REvil USES ransomware as a service
REvil operated a ransomware-as-a-service model in which affiliates deployed the malware and split ransom payments with the REvil operation.
Explicit Confidence 99% · Jack Rhysider EP 126 Details
“the group behind REvil saw how much money GandCrab made as a service that they realized that’s what they should focus on”
REvil typically received ransom payments in Bitcoin.
Explicit Confidence 99% · Jack Rhysider EP 126 Details
“when REvil gets a ransomware payment, they typically receive it in Bitcoin”
REvil typically converted Bitcoin ransom proceeds into Monero to make laundering and tracing more difficult.
Explicit Confidence 96% · Jack Rhysider EP 126 Details
“they’re actually pretty good at laundering that money by typically converting it into Monero”
REvil USES privilege escalation
REvil attackers escalated privileges to domain-administrator level before deploying the ransomware.
Explicit Confidence 99% · Will EP 126 Details
“they’ve escalated their privileges to domain administrator level”
GandCrab USES ransomware as a service
GandCrab evolved from ransomware into a ransomware-as-a-service operation for customers and affiliates.
Explicit Confidence 98% · Jack Rhysider EP 126 Details
“GandCrab wasn’t just ransomware, but it evolved into ransomware as a service.”
GandCrab used open-source information about companies’ profits and turnover to select lucrative targets.
Explicit Confidence 98% · Jack Rhysider EP 126 Details
“to figure that out, GandCrab did some OSINT.”
FIN7 tried REvil in several attacks before deciding to develop its own ransomware.
Explicit Confidence 98% · Will EP 126 Details
“They had tried out REvil for a few times.”
Will says REvil came out of another variant called GandCrab.
Explicit Confidence 99% · Will EP 126 Details
“REvil first came out of another variant called GandCrab”