revil (15)

9582988691?profile=RESIZE_400xActivity Summary - Week Ending 17 September 2021:

  • Red Sky Alliance identified 37,866 connections from new unique IP addresses
  • Analysts identified 765 new IP addresses participating in various Botnets
  • Compromised IP: 107.172.100.248
  • Is it REvil or is it the Feds?
  • BazarLoader
  • QakBot
  • BlackMatter and Cameras?
  • Grayfly – an Arm of APT41
  • EasyJet in the Crosshairs
  • Just Who’s Winning the Cyber War?
  • Tiananmen Square Memorials

Link to full report: IR-21-260-001_weekly_260.pdf

9554622473?profile=RESIZE_400xOur friends at several cyber media outlets are reporting that the operators behind the REvil ransomware-as-a-service (RaaS) is back.  In a surprise return, REvil reappeared after a two-month break following the widely publicized attack on technology services provider Kaseya on 4 July 2021.  In fact, Red Sky Alliance analysts observed its return this past week.

Two of the dark web portals, including the gang's Happy Blog data leak site and its payment/negotiation site, have reappeared online, wit

9315119659?profile=RESIZE_400xRecently, ransomware criminals claimed as trophies at least three North American insurance brokerages that offer policies to help others survive the very network-paralyzing, data-pilfering extortion attacks they themselves apparently suffered.

Cybercriminals who hack into corporate and government networks to steal sensitive data for extortion routinely try to learn how much cyber insurance coverage the victims have. Knowing what victims can afford to pay can give them an edge in ransom negotiati

9225341064?profile=RESIZE_400xActivity Summary - Week Ending 9 July 2021:

  • Red Sky Alliance identified 56,261 connections from new unique IP addresses
  • Analysts identified 2,346 new IP addresses participating in various Botnets
  • 12 unique email accounts compromised were seen with Keyloggers
  • RevengeRAT & Aviation
  • Kaseya Attack
  • Babuk Locker
  • PayLoad Bin
  • Space ISAC & Microsoft
  • SideCopy
  • A change in social media collection?
  • DuckDuckGo, Good to Go

Link to full report: IR-21-190-001_weekly_190.pdf

9208836301?profile=RESIZE_400xLast weekend did not start out so nice.  The hacking group behind what media is calling ‘colossal ransomware attack’ has demanded $70m (£50.5m) paid in Bitcoin in return for a "universal decryptor" that it says will unlock the files of all victims.  The Russian associated REvil group is saying its malware, which initially targeted US IT firm Kaseya, has hit one million "systems." 

This number has not been totally verified and the exact total of victims is unknown.  Yet, victims include 500 Swedi

9089052477?profile=RESIZE_400xThe decision to pay the ransom demanded by the cybercriminal group was to avoid any further issues or potential problems for its customers, according to the company’s CEO.  JBS Foods paid the equivalent of $11 million in ransom after a cyber-attack that forced the company to shut down some operations in the United States and Australia over the Memorial Day weekend.

The company made the payment to cybercriminals to ensure the protection of its data and mitigate any further damage to its customers

8725760658?profile=RESIZE_400xThe threat group behind the Sodinokibi ransomware claimed to have recently compromised nine organizations.  The REvil ransomware threat group is on a cyberattack tear, claiming over the past three weeks to have infected ten organizations across Africa, Europe, Mexico and the US.  The organizations include two law firms, an insurance company, an architectural firm, a construction company and an agricultural co-op, all located in the US; as well as two large international banks (one in Mexico and

8566308097?profile=RESIZE_400xNo one needs reminding that ransomware has reached incredible proportions; one widely reported statistic from Purplesec suggests that $20 billion was paid out in 2020. That's almost double its $11.5 billion estimate from 2019, with a commensurately huge increase in the number of attacks, while BitDefender suggested a 715% increase in the first half of the year.

The "crews" have multiplied, adopted tactics that are reminiscent of nation-state attacks, and developed partnerships and relationships

8522620286?profile=RESIZE_400xActivity Summary - Week Ending 5 February 2021:

  • Red Sky Alliance identified 34,976 connections from new unique IP addresses
  • Greek Bank, Alpha Bank Group has an Attack Server (C2) Compromise
  • DigitalOcean has a Compromised (C2) IP
  • Analysts identified 2,089 new IP addresses participating in various Botnets
  • PowerShell Dropping REvil
  • Ursnif/Gozi using INPS as Bait
  • How the World Ends
  • US – Russia Cyber Strategy
  • Rocket Chat (Al Qaeda) urging Cyber Terrorism
  • Operation Lady-Bird
  • Electric Grids – Still a

8196171482?profile=RESIZE_400xRemember the Dark Side comics?  Well, the DarkSide criminal hacking group is no laughing matter.  The DarkSide Ransomware gang claims they are creating a distributed storage system in Iran to store and leak data stolen from victims.  DarkSide is operated as a Ransomware-as-a-Service (RaaS) where developers control programming the ransomware software and payment site, and affiliates are recruited to hack businesses and encrypt their devices.

DarkSide is the latest ransomware criminal gang to anno

8157019075?profile=RESIZE_400xActivity Summary - Week Ending 13 November 2020:

  • Red Sky Alliance observed 67 unique email accounts compromised with Keyloggers
  • Analysts identified 42,222 connections from new unique IP addresses
  • 2,563 new IP addresses were observed Participating in various Botnets
  • Hezbollah is the Top Threat actor this week targeting Israel, US, Lebanon, Syria and Iran
  • TrickBot and BazarLoader
  • WatchBogMiner
  • Ransomware blocks electronic Stadium Entrances
  • A UK Premier League soccer club's Managing Director was H

8131231863?profile=RESIZE_400xIt should come as no reprise that ransomware groups that steal a company's data and then get paid a fee to delete it don't always follow through on their promise.

The number of cases where this has happened has increased, according to a report[1] published by Coveware this week and according to several incidents shared by security researchers with ZDNet researchers over the past few months. These incidents take place only for a certain category of ransomware attacks — namely those carried out by

5887188088?profile=RESIZE_400xLike any profitable business model, ransomware gangs continue to innovate and increase their business.  Recently, reports have emerged of a collaboration between the Maze and Lockbit gangs, as well as the REvil, aka Sodinokibi, operators not leaking stolen data for free when victims do not pay, but instead auctioning it off to the highest bidder.

Here are some of the latest ransomware trends noted by cyber analysts: IR-20-164-002_Ransomware Trends.pdf

4304188497?profile=RESIZE_710xOur Friends at the FBI issued a cyber bulletin on 04 01 2020.  This was no April Fool's Joke, but a serious cyber warning on the Sodinokibi Ransomware (pic: tgsoft.it), also known as REvil, Bluebackground, or Sodin.  Red Sky Alliance / Wapack Labs was already researching this ransomware.  Last week, Jesse Burke our Chief of Special Operations, provided a brief on Sodinokibi Ransomware.  Look to your right (Did you miss the March Cyber Intelligence Briefing (CIB). Topics: Coronavirus Lures and Bu