Threat actor
threat_actor:revil
Also: REvil cyber-gang, REvil ransomware crew
Russian-speaking ransomware operation that provided REvil through a ransomware-as-a-service model.
Russian-speaking ransomware operation that provided REvil through a ransomware-as-a-service model.
“the name of both the ransomware and the group operating it”
“the REvil core business, the core ransomware as a service business”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | USES | ransomware as a service | Explicit | 126 |
| outgoing | USES | OSINT | Explicit | 126 |
| outgoing | USES | Remote Desktop Protocol | Explicit | 126 |
| outgoing | USES | web shell | Explicit | 126 |
| outgoing | USES | PowerShell | Explicit | 126 |
| outgoing | USES | lateral movement | Explicit | 126 |
| outgoing | USES | privilege escalation | Explicit | 126 |
| outgoing | USES | scheduled task | Explicit | 126 |
| outgoing | USES | double extortion | Explicit | 126 |
| outgoing | USES | Distributed denial-of-service | Explicit | 126 |
| outgoing | USES | Tor | Explicit | 126 |
| outgoing | USES | Bitcoin | Explicit | 126 |
| outgoing | USES | Monero | Explicit | 126 |
| outgoing | ASSOCIATED_WITH | Federal Security Service | Uncertain | 126 |
| incoming | ASSOCIATED_WITH | Yaroslav Vasinskyi | Attributed | 126 |
| incoming | ASSOCIATED_WITH | Yevgeniy Polyanin | Attributed | 126 |
REvil USES ransomware as a service
REvil operated a ransomware-as-a-service model in which affiliates deployed the malware and split ransom payments with the REvil operation.
Explicit Confidence 99% · Jack Rhysider EP 126 Details
“the group behind REvil saw how much money GandCrab made as a service that they realized that’s what they should focus on”
REvil affiliates used OSINT to choose targets before seeking access to their networks.
Explicit Confidence 98% · Will EP 126 Details
“It would start with the OSINT, it would start with picking a target”
REvil USES Remote Desktop Protocol
Will says attackers could buy RDP credentials as an entry point for REvil attacks.
Explicit Confidence 97% · Will EP 126 Details
“you can buy RDP credentials”
After exploiting a public-facing server vulnerability, REvil attackers deployed a web shell to establish an initial foothold.
Explicit Confidence 98% · Will EP 126 Details
“they would deploy a web shell or some – launch some power shell codes on the server, establish that initial foothold”
REvil USES PowerShell
REvil attackers used PowerShell code on compromised servers after exploiting a vulnerability.
Explicit Confidence 96% · Will EP 126 Details
“launch some power shell codes on the server”
REvil USES lateral movement
After gaining an initial foothold, REvil attackers performed reconnaissance and spread through the network.
Explicit Confidence 98% · Will EP 126 Details
“do some reconnaissance inside the network and then spread around as best they can”
REvil USES privilege escalation
REvil attackers escalated privileges to domain-administrator level before deploying the ransomware.
Explicit Confidence 99% · Will EP 126 Details
“they’ve escalated their privileges to domain administrator level”
REvil USES scheduled task
REvil commonly deployed ransomware by scheduling a task on computers across the network using domain-administrator credentials.
Explicit Confidence 99% · Will EP 126 Details
“the common way they deploy it is via scheduling a task on all the computers in the network”
REvil USES double extortion
REvil used double extortion by encrypting files and leaking stolen data.
Explicit Confidence 99% · Will EP 126 Details
“double extortion, was encrypting your files and then leaking your data”
REvil USES Distributed denial-of-service
REvil added a further extortion tactic by DDoSing victims or their partners until negotiations began.
Explicit Confidence 99% · Will EP 126 Details
“they would now begin to DDoS you or your partners”
REvil leaked stolen victim data to a Tor website described as a wall of shame.
Explicit Confidence 98% · Will EP 126 Details
“leaking it with – to a Tor website”
REvil typically received ransom payments in Bitcoin.
Explicit Confidence 99% · Jack Rhysider EP 126 Details
“when REvil gets a ransomware payment, they typically receive it in Bitcoin”
REvil typically converted Bitcoin ransom proceeds into Monero to make laundering and tracing more difficult.
Explicit Confidence 96% · Jack Rhysider EP 126 Details
“they’re actually pretty good at laundering that money by typically converting it into Monero”
Yaroslav Vasinskyi ASSOCIATED_WITH REvil
Vasinskyi was presented as an alleged REvil affiliate and alleged perpetrator of the Kaseya-related ransomware attack.
Attributed Confidence 94% · Garland EP 126 Details
“bringing to justice an alleged perpetrator of a significant, wide-reaching ransomware attack”
Yevgeniy Polyanin ASSOCIATED_WITH REvil
Polyanin was charged as an alleged REvil ransomware attacker associated with approximately 3,000 attacks.
Attributed Confidence 96% · Will EP 126 Details
“Polyanin, whom we also charged by indictment, is alleged to have conducted approximately 3,000 ransomware attacks”
REvil ASSOCIATED_WITH Federal Security Service
The FSB claimed to have arrested fourteen REvil members in Russia; the episode questions the credibility and meaning of those arrests.
Uncertain Confidence 86% · Will EP 126 Details
“the Russian FSB released a press release that said they had arrested fourteen members of REvil”