Russian Ransomware Group REvil Back Online After 2-Month Hiatus

The operators behind the REvil ransomware-as-a-service (RaaS)
staged^[1]
a surprise return after a two-month hiatus following the widely
publicized attack on technology services provider Kaseya on July
4.

Two of the dark web portals, including the gang’s Happy Blog
data leak site and its payment/negotiation site, have resurfaced
online, with the most recent victim added on July 8, five days
before the sites mysteriously went off the grid^[2] on July 13. It’s not
immediately clear if REvil is back in the game or if they have
launched new attacks.

“Unfortunately, the Happy Blog is back online,” Emsisoft threat
researcher Brett Callow tweeted^[3]
on Tuesday.

The development comes a little over two months after a wide-scale supply chain ransomware
attack^[4] aimed at Kaseya, which
saw the Russia-based cybercrime gang encrypting approximately 60
managed service providers (MSPs) and over 1,500 downstream
businesses using a zero-day vulnerability in the Kaseya VSA remote
management software.

In late May, REvil also spearheaded the attack^[5]
on the world’s largest meat producer JBS, forcing the company to
shell out $11 million in ransom to the extortionists to recover
from the incident.

Following the attacks and increased international scrutiny in
the wake of the global ransomware crisis, the group took its dark
web infrastructure down, leading to speculations that it may have
temporarily ceased operations with the goal of rebranding under a
new identity so as to attract less attention.

REvil, also known as Sodinokibi, emerged as the fifth most
commonly reported ransomware strains in Q1 2021, accounting for
4.60% of all submissions in the quarter, according to statistics^[6]
compiled by Emsisoft.