Here’s an overview of some of last week’s most interesting news and articles: Kaseya obtains universal REvil decryptor There’s finally some good news for the MSPs and their customers that have been hit by...
McAfee Labs described the use of DLL sideloading in REvil’s attacks after the group made a sudden exit that surprised everyone. Generally, this technique is used by APT groups to avoid raising any flags...
A look at part of the REvil group’s online infrastructure shows clear lines to Russian and U.K. service providers that, in theory, could help law enforcement agencies but don’t appear eager to help. click...
After wreaking havoc in the corporate world, the notorious REvil ransomware suddenly went offline. Neither… The Notorious REvil Ransomware Gang Go Offline on Latest Hacking News. click here to read full Article Read more...
The infrastructure and websites for the REvil ransomware operation have mysteriously disappeared from the dark web, speculating that the criminal enterprise may have been taken down. The REvil ransomware operation, aka Sodinokibi, operates through...
Interpol announced that it will boost the role of country-specific National Central Bureaus, among other measures, to develop a global strategy for ransomware mitigation. click here to read full Article Read More on latest...
Before claiming responsibility for a breach at the software company Kaseya, the group accounted for less than 10% of known ransomware victims, according to the threat intelligence firm Recorded Future. Now, it accounts for...
The REvil ransomware gang’s attack on MSPs and their customers last week outwardly should have been successful, yet changes in their typical tactics and procedures have led to few ransom payments. click here to...
In most cases, the REvil ransomware group utilizes Cobalt Strike BEACON and RDP with previously compromised credentials to laterally move throughout compromised environments. click here to read full Article Read more on computer hacking...
Kaseya: 1,500 organizations affected by REvil attacks click here to read full Article Read More on latest Security Updates
An attack perpetrated by REvil aka Sodinokibi ransomware gang against Managed Service Providers (MSPs) and their clients was discovered on July 2. Some of the victims have reportedly been compromised through a popular MSP...
This is the highest ransom demand in history, the previous record also belonging to REvil, asking $50 million after attacking Taiwanese electronic and computer maker Acer. click here to read full Article Read more...
Threat actors behind the notorious REvil cybercrime operation appear to have pushed ransomware via an update for Kaseya’s IT management software, hitting around 40 customers worldwide, in what’s an instance of a widespread supply-chain...
MalwareHunterTeam is alerting about the Linux version of the REvil ransomware that purportedly targets VMware ESXi servers. By targeting virtual machines, REvil can encrypt multiple servers with just a single command. Experts recommend installing VMware...
Advanced Intel’s Vitali Kremez told BleepingComputer that the new Linux variant is an ELF64 executable and includes the same configuration options utilized by the more common Windows executable. click here to read full Article...
The LV variant operators have been observed in the wild since October 2020, deploying a tweaked version of REvil’s binary with references to REvil’s C2 and data exfiltration infrastructure removed. click here to read...
