But some security researchers suspected the group was bluffing, and the Trump administration designated REvil as a terrorist group. REvil also took credit for hacking New York law firm Grubman, Shire, Meiselas & Sacks, claiming to have obtained documents related to former President Donald Trump. But as tech publication MacRumors reported in April, REvil “mysteriously removed all references related to the extortion attempt from its dark web blog.” It’s unclear whether Apple or Quanta paid the ransom. REvil said it was able to steal sensitive data from Apple like computer designs and demanded a $50 million ransom. What else has REvil hacked?īesides Kaseya and JBS, REvil has been linked to high-profile ransomware attacks, including against Quanta, a Taiwanese company that sells data center gear to Apple. Hacking groups that are financially motivated, he said, can be more dangerous than nation-state hacking groups because they are more willing to “shut down hospitals.” Nation-state hacking groups operate by “unwritten rules and norms” that typically mean they avoid engineering hacks that could kill people, like shutting down a hospital, he explained. In exchange for using REvil’s services and malware, REvil, like similar groups, takes a roughly 20% cut of any ransomware payments while its affiliate hackers keep the other 80%, he added. REvil members have created online infrastructure on the dark web, a part of the Internet that search engines like Google don’t track, for other hackers to post stolen documents and collect ransomware payments from victims, Narang said.
REvil acts a business that sells hacking technology and other tools to third-party hackers. This gives credence to the notion that former GandCrab members are now with REvil. Narang noted that the GandCrab group targeted managed service providers, which operate IT systems on behalf of other companies, during its final days. That said, with the number of similar ransomware groups, it’s hard to determine which hacking group is responsible for specific attacks. Tony Cook, ransomware negotiator and head of threat intelligence at GuidePoint Security, said REvil appears to be inspired by GandCrab in that the two groups use similar tool and hacking techniques. The group is also known as Sodinokibi, and security researchers have previously named the organization’s family of malware that encrypts, or scrambles data REvil/Sodinokibi, or REvil.Sodinokibi. REvil’s name is an amalgam of “ransomware” and “evil,” said Satnam Narang, a staff research engineer for the security firm Tenable. Here’s what you need to know about the notorious hacking group and its ransomware attacks. Although JBS said it was able to regain control of its computer systems, it paid a $11 million ransom to “mitigate any unforeseen issues related to the attack and ensure no data was exfiltrated.” In June, the FBI said REvil was behind the massive cyber attack that shut down the operations of JBS the world’s biggest meat supplier.
#Cable krebs stamos group ransomwhere software#
To gain access to the victims, the hackers exploited a bug in the IT management software of Kaseya. The Kaseya attack, which started last Friday, hit a number of companies and organizations, including Sweden’s largest supermarket chain Coop and schools in New Zealand.
0 kommentar(er)
