Episode
18 October 2022 Official episode · Official transcript
cybercrime bitcoin
The episode examines the REvil ransomware operation, its origins in GandCrab, ransomware-as-a-service model, major attacks including Kaseya, and the law-enforcement actions that disrupted it.
Topics: ransomware-as-a-service, big-game ransomware targeting, initial access brokers, public-facing server exploitation, web shells, PowerShell execution, network reconnaissance, lateral movement, privilege escalation, domain administrator compromise, scheduled-task deployment, backup destruction, double extortion, data-leak sites, distributed denial-of-service extortion, managed service providers, supply-chain attacks, ransomware negotiation, Bitcoin ransom payments, Monero laundering, cyber insurance targeting, law-enforcement decryption and disruption
Links published on the Darknet Diaries episode page. Not LLM output.
Qualified statements from this episode, not graph facts.
Will MEMBER_OF Equinix Threat Analysis Center
Will says he works for the Equinix Threat Analysis Center as a threat intelligence analyst.
Explicit Confidence 99% · Will EP 126 Details
“I work for the Equinix Threat Analysis Center. I’m a threat intelligence analyst.”
Will says REvil came out of another variant called GandCrab.
Explicit Confidence 99% · Will EP 126 Details
“REvil first came out of another variant called GandCrab”
GandCrab USES big game hunting
Will says the GandCrab group pioneered big game hunting, meaning attacks focused on large, wealthy companies.
Explicit Confidence 96% · Will EP 126 Details
“GandCrab is – it was basically the group that pioneered what we call big game hunting.”
GandCrab USES ransomware as a service
GandCrab evolved from ransomware into a ransomware-as-a-service operation for customers and affiliates.
Explicit Confidence 98% · Jack Rhysider EP 126 Details
“GandCrab wasn’t just ransomware, but it evolved into ransomware as a service.”
GandCrab used open-source information about companies’ profits and turnover to select lucrative targets.
Explicit Confidence 98% · Jack Rhysider EP 126 Details
“to figure that out, GandCrab did some OSINT.”
GandCrab USES initial access broker
GandCrab obtained access to companies through the underground initial-access market.
Explicit Direction flagged Confidence 95% · Jack Rhysider EP 126 Details
“this is how the GandCrab group would infect companies; they’d buy access into a company”
REvil USES ransomware as a service
REvil operated a ransomware-as-a-service model in which affiliates deployed the malware and split ransom payments with the REvil operation.
Explicit Confidence 99% · Jack Rhysider EP 126 Details
“the group behind REvil saw how much money GandCrab made as a service that they realized that’s what they should focus on”
REvil affiliates used OSINT to choose targets before seeking access to their networks.
Explicit Confidence 98% · Will EP 126 Details
“It would start with the OSINT, it would start with picking a target”
REvil USES Remote Desktop Protocol
Will says attackers could buy RDP credentials as an entry point for REvil attacks.
Explicit Confidence 97% · Will EP 126 Details
“you can buy RDP credentials”
After exploiting a public-facing server vulnerability, REvil attackers deployed a web shell to establish an initial foothold.
Explicit Confidence 98% · Will EP 126 Details
“they would deploy a web shell or some – launch some power shell codes on the server, establish that initial foothold”
REvil USES PowerShell
REvil attackers used PowerShell code on compromised servers after exploiting a vulnerability.
Explicit Confidence 96% · Will EP 126 Details
“launch some power shell codes on the server”
REvil USES lateral movement
After gaining an initial foothold, REvil attackers performed reconnaissance and spread through the network.
Explicit Confidence 98% · Will EP 126 Details
“do some reconnaissance inside the network and then spread around as best they can”
REvil USES privilege escalation
REvil attackers escalated privileges to domain-administrator level before deploying the ransomware.
Explicit Confidence 99% · Will EP 126 Details
“they’ve escalated their privileges to domain administrator level”
REvil USES scheduled task
REvil commonly deployed ransomware by scheduling a task on computers across the network using domain-administrator credentials.
Explicit Confidence 99% · Will EP 126 Details
“the common way they deploy it is via scheduling a task on all the computers in the network”
REvil USES double extortion
REvil used double extortion by encrypting files and leaking stolen data.
Explicit Confidence 99% · Will EP 126 Details
“double extortion, was encrypting your files and then leaking your data”
REvil USES Distributed denial-of-service
REvil added a further extortion tactic by DDoSing victims or their partners until negotiations began.
Explicit Confidence 99% · Will EP 126 Details
“they would now begin to DDoS you or your partners”
REvil leaked stolen victim data to a Tor website described as a wall of shame.
Explicit Confidence 98% · Will EP 126 Details
“leaking it with – to a Tor website”
REvil typically received ransom payments in Bitcoin.
Explicit Confidence 99% · Jack Rhysider EP 126 Details
“when REvil gets a ransomware payment, they typically receive it in Bitcoin”
REvil typically converted Bitcoin ransom proceeds into Monero to make laundering and tracing more difficult.
Explicit Confidence 96% · Jack Rhysider EP 126 Details
“they’re actually pretty good at laundering that money by typically converting it into Monero”
REvil EXPLOITS Kaseya servers vulnerability
The Kaseya attack used a vulnerability on Kaseya’s servers to give REvil a foothold.
Explicit Confidence 99% · Jack Rhysider EP 126 Details
“There was a vulnerability on Kaseya’s servers that gave REvil the foothold to take over a server.”
REvil AFFECTS Kaseya VSA
REvil exploited Kaseya VSA to reach managed service providers and their customers.
Explicit Confidence 99% · Will EP 126 Details
“by exploiting the Kaseya software to deploy REvil, they were able to hit 1,500 networks in one go overnight”
Kaseya ransomware attack INVOLVES REvil
The Kaseya ransomware attack involved REvil ransomware.
Explicit Confidence 99% · Will EP 126 Details
“The Kaseya attack popped up and it said – this is what REvil wrote”
Kaseya ransomware attack INVOLVES supply chain attack
The Kaseya incident was described as a major supply-chain incident because compromise of Kaseya reached downstream customers.
Explicit Confidence 99% · Will EP 126 Details
“The Kaseya, that was basically one of the biggest supply chain incidents since NotPetya.”
Kaseya ransomware attack INITIAL_ACCESS_VIA Kaseya VSA
REvil gained access to downstream networks through Kaseya VSA.
Derived Confidence 97% · Will EP 126 Details
“by going into the Kaseya software, REvil basically had a foothold into all of the MSP’s customers”
Travelex ransomware attack INVOLVES REvil
Will says Travelex was hit by REvil ransomware, based on a report he had read.
Attributed Confidence 95% · Will EP 126 Details
“Travelex had been hit by REvil ransomware”
Texas government REvil attack INVOLVES REvil
The Texas government incident involved deployment of REvil through a managed service provider.
Explicit Confidence 99% · Will EP 126 Details
“one of the REvil affiliates managed to get into the Texas government and deploy”
GSM Law ransomware attack INVOLVES REvil
REvil allegedly accessed GSM Law and stole hundreds of gigabytes of data.
Uncertain Confidence 94% · Will EP 126 Details
“REvil managed to get into GSM Law and steal – allegedly steal hundreds of gigabytes of data from them”
JBS ransomware attack INVOLVES REvil
The episode presents the JBS ransomware attack as part of the ransomware activity discussed around REvil, but does not explicitly identify the malware as REvil in the quoted passage.
Uncertain Confidence 52% · Will EP 126 Details
“That was a huge international incident. Everyone said that was the one step too far.”
FIN7 tried REvil in several attacks before deciding to develop its own ransomware.
Explicit Confidence 98% · Will EP 126 Details
“They had tried out REvil for a few times.”
Will identifies DarkSide as FIN7’s first ransomware project.
Explicit Confidence 97% · Will EP 126 Details
“DarkSide was FIN7’s first ransomware project.”
REvil DEVELOPED_BY Yaroslav Vasinskyi
The U.S. Attorney General said the indictment charged that Vasinskyi and co-conspirators authored REvil software; this is an allegation in the indictment, not an adjudicated fact.
Attributed Confidence 98% · Jack Rhysider EP 126 Details
“The indictment charges that Vasinskyi and co-conspirators authored REvil software”
Yaroslav Vasinskyi ASSOCIATED_WITH REvil
Vasinskyi was presented as an alleged REvil affiliate and alleged perpetrator of the Kaseya-related ransomware attack.
Attributed Confidence 94% · Garland EP 126 Details
“bringing to justice an alleged perpetrator of a significant, wide-reaching ransomware attack”
Yevgeniy Polyanin ASSOCIATED_WITH REvil
Polyanin was charged as an alleged REvil ransomware attacker associated with approximately 3,000 attacks.
Attributed Confidence 96% · Will EP 126 Details
“Polyanin, whom we also charged by indictment, is alleged to have conducted approximately 3,000 ransomware attacks”
REvil ASSOCIATED_WITH Federal Security Service
The FSB claimed to have arrested fourteen REvil members in Russia; the episode questions the credibility and meaning of those arrests.
Uncertain Confidence 86% · Will EP 126 Details
“the Russian FSB released a press release that said they had arrested fourteen members of REvil”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T07:46:09.521370+00:00