Will says REvil came out of another variant called GandCrab.
Explicit Confidence 99% · Will EP 126 Details
“REvil first came out of another variant called GandCrab”
Malware
malware:revil
Also: R Ransomware Evil
Ransomware malware used to encrypt victims' systems and support extortion operations.
Ransomware malware used to encrypt victims' systems and support extortion operations.
“They created a new ransomware malware. This time they called it REvil”
“REvil first appeared in April 2019”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | VARIANT_OF | GandCrab | Explicit | 126 |
| outgoing | EXPLOITS | Kaseya servers vulnerability | Explicit | 126 |
| outgoing | AFFECTS | Kaseya VSA | Explicit | 126 |
| outgoing | DEVELOPED_BY | Yaroslav Vasinskyi | Attributed | 126 |
| incoming | INVOLVES | Kaseya ransomware attack | Explicit | 126 |
| incoming | INVOLVES | Travelex ransomware attack | Attributed | 126 |
| incoming | INVOLVES | Texas government REvil attack | Explicit | 126 |
| incoming | INVOLVES | GSM Law ransomware attack | Uncertain | 126 |
| incoming | INVOLVES | JBS ransomware attack | Uncertain | 126 |
| incoming | USES | FIN7 | Explicit | 126 |
Will says REvil came out of another variant called GandCrab.
Explicit Confidence 99% · Will EP 126 Details
“REvil first came out of another variant called GandCrab”
REvil EXPLOITS Kaseya servers vulnerability
The Kaseya attack used a vulnerability on Kaseya’s servers to give REvil a foothold.
Explicit Confidence 99% · Jack Rhysider EP 126 Details
“There was a vulnerability on Kaseya’s servers that gave REvil the foothold to take over a server.”
REvil AFFECTS Kaseya VSA
REvil exploited Kaseya VSA to reach managed service providers and their customers.
Explicit Confidence 99% · Will EP 126 Details
“by exploiting the Kaseya software to deploy REvil, they were able to hit 1,500 networks in one go overnight”
Kaseya ransomware attack INVOLVES REvil
The Kaseya ransomware attack involved REvil ransomware.
Explicit Confidence 99% · Will EP 126 Details
“The Kaseya attack popped up and it said – this is what REvil wrote”
Travelex ransomware attack INVOLVES REvil
Will says Travelex was hit by REvil ransomware, based on a report he had read.
Attributed Confidence 95% · Will EP 126 Details
“Travelex had been hit by REvil ransomware”
Texas government REvil attack INVOLVES REvil
The Texas government incident involved deployment of REvil through a managed service provider.
Explicit Confidence 99% · Will EP 126 Details
“one of the REvil affiliates managed to get into the Texas government and deploy”
GSM Law ransomware attack INVOLVES REvil
REvil allegedly accessed GSM Law and stole hundreds of gigabytes of data.
Uncertain Confidence 94% · Will EP 126 Details
“REvil managed to get into GSM Law and steal – allegedly steal hundreds of gigabytes of data from them”
JBS ransomware attack INVOLVES REvil
The episode presents the JBS ransomware attack as part of the ransomware activity discussed around REvil, but does not explicitly identify the malware as REvil in the quoted passage.
Uncertain Confidence 52% · Will EP 126 Details
“That was a huge international incident. Everyone said that was the one step too far.”
FIN7 tried REvil in several attacks before deciding to develop its own ransomware.
Explicit Confidence 98% · Will EP 126 Details
“They had tried out REvil for a few times.”
REvil DEVELOPED_BY Yaroslav Vasinskyi
The U.S. Attorney General said the indictment charged that Vasinskyi and co-conspirators authored REvil software; this is an allegation in the indictment, not an adjudicated fact.
Attributed Confidence 98% · Jack Rhysider EP 126 Details
“The indictment charges that Vasinskyi and co-conspirators authored REvil software”