Snynet Solution Logo
MON - SUN: 10 AM - 6 PM
+60 11 5624 8319


REvil is back - and wants to rebuild its reputation

Image Description

An alleged representative of the notorious REvil ransomware gang has started engaging with members on the Russian-language Exploit cybercrime forum, sharing details about the group’s apparent re-emergence.

After being offline for a majority of two months, several of the dark-web servers belonging to REvil came back online recently.

REvil went offline after orchestrating the Kaseya attacks back in July, following which its properties on both the dark-web and normal web went offline. The disappearance led to speculation that the group could have been hit by law enforcement agencies, especially since the emergence of a universal decryptor key to help all victims unlock their machines. 

TechRadar needs you!

We're looking at how our readers use VPNs with streaming sites like Netflix so we can improve our content and offer better advice. This survey won't take more than 60 seconds of your time, and we'd hugely appreciate if you'd share your experiences with us.

>> Click here to start the survey in a new window

However, the purported representative now claims the release of the universal key was an accident, which when discovered was forwarded to law enforcement agencies. 

“One of our coders misclicked and generated a universal key, and issued the universal decryptor key along with a bunch of keys for one machine,” wrote REvil’s new representative in the Russian-post translated by security researchers at Flashpoint.

Mending bridges?

Surprisingly though, the representative didn’t offer any explanation on the disappearance of the group. However, the post didn’t mention that the group was able to restore their operations from backup, which perhaps means that it was targeted in some kind of an offensive operation by the good guys. 

In any case, after being in the dark for several weeks, the group has started to restore its online properties. While the cybersecurity community is still skeptical of the group’s return, Flashpoint has seen at least one instance of the group trying to rebuild their reputation with former collaborators, who weren’t pleased with REvil’s sudden disappearance. 

According to Flashpoint, a threat actor on the forum, opened an arbitration case against the REvil spokesperson for unpaid dues from an earlier operation, but soon marked it as resolved, which perhaps indicates that REvil has cleared its dues. 

If there’s merit in REvil’s efforts to rebuild ties with old affiliates, it would nicely tie into the narrative of security vendor Exabeam’s chief security strategist, Steve Moore, who told us last week that the group took the downtime to regroup, and is all set to resume operations, with gusto.


13 Sep 2021



Other Blog

  • This Virgin broadband deal offers superfast speeds, low costs and big vouchers

    Virgin's broadband deals are frequently leading the market and its latest offer is no exception.

    Read More
  • N64 games on the Nintendo Switch are confirmed, but could Dreamcast be next?

    With Genesis games coming to Switch Online, it now lays the foundation for more systems from SEGA to arrive.

    Read More
  • Samsung Galaxy tablets - some of the best iPad alternatives - are on sale at Amazon

    These new Samsung Galaxy tablets are fantastically discounted ahead of Amazon Prime Day.

    Read More
  • Why finding webcams in stock may get even harder soon

    Webcams have become a hot property ever since the pandemic hit, and it doesn’t look like demand will die down anytime soon.

    Read More

Find Out More About Us

Want to hire best people for your project? Look no further you came to the right place!

Contact Us