REvil ransomware operation shuts down once again

It seems that the REvil ransomware operation has shut down once again after a threat actor has hijacked their Tor hidden service.

The REvil ransomware gang has shut down its operation once again after a threat actor has hijacked their Tor leak site and payment portal. The news of the hack was shared by the REvil representive ‘0_neday’ on the XSS hacking forum, he initially confirmed that someone has compromised their server, later denied it.

The news of the hack was first reported by Dmitry Smilyanets from Recorded Future.

RIP #REvil pic.twitter.com/LJKnJI9YtW

— 𝕯𝖒𝖎𝖙𝖗𝖞 𝕾𝖒𝖎𝖑𝖞𝖆𝖓𝖊𝖙𝖘 (@ddd1ms) October 17, 2021

REvil gives additional update. REvil representive ‘0_neday’ states their server has been compromised.

“Good luck everyone, I’m off” – 0_neday

Intel courtesy of @ddd1ms pic.twitter.com/cKvev4uDu5

— vx-underground (@vxunderground) October 17, 2021

0_neday added that someone brought up the REvil hidden services using their private keys, he also said that the gang did not found signs of compromise to their servers, anyway, they have decided to shut down the operation. 

“But since we have today at 17.10 from 12:00 Moscow time, someone brought up the hidden-services of a landing and a blog with the same keys as ours, my fears were confirmed. The third party has backups with onion service keys,” wrote ‘0_neday’ on the hacking forum.

REvil disappearance update:

Summary:
* REvil rep. ‘Unknown’ disappeared
* REvil assumed Unknown was dead
* REvil decided to continue operations
* Only ‘Unknown’ & ‘0_neday’ had REvil domain keys
* REvil domain recently accessed using Unknown’s keys

Intel courtesy of @ddd1ms pic.twitter.com/fsk5PdOt2n

— vx-underground (@vxunderground) October 17, 2021

REvil operators will provide anyway the decryption keys to the affiliates to allow them to continue their operations.

At the time of this writing, it is not clear how threat actors could have had access to the private keys of the REvil operation, someone speculates that the keys were obtained by law enforcement since they resumed their activity in September after a short pause.

On July 2, the REvil ransomware gang hit the Kaseya cloud-based MSP platform impacting MSPs and their customers.

The group asked $70 million worth of Bitcoin for decrypting all systems impacted in the Kaseya supply-chain ransomware attack.

The attack caught the attention of the media and the police authorities that increased pressure on the group.

Starting from July 13, the infrastructure and the websites used by the REvil ransomware gang were mysteriously unreachable. The Tor leak site, the payment website “decoder[.]re”, and their backend infrastructure went offline simultaneously.

It is not clear if the operators shut down the operations due to the pressure of law enforcement after the recent Kaseya massive ransomware attack or if the infrastructure was seized as a result of an operation conducted by law enforcement.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, REvil ransomware operation)

The post REvil ransomware operation shuts down once again appeared first on Security Affairs.

Recent Posts
Contact Us

We're not around right now. But you can send us an email and we'll get back to you, asap.

Not readable? Change text. captcha txt