REvil Group Claims Slew of Ransomware Attacks

March 12, 2021
Threatpost reports that the REvil ransomware threat group, also known as the Sodinokibi ransomware gang, claimed to have compromised a total of nine organizations in the U.S., Europe, Africa and Mexico in the last two weeks. Researchers with eSentire analyzed the group’s claims and stated that the affected organizations included an insurance company, a construction firm, an architectural company, two law firms and an agricultural co-op in the U.S.; a manufacturer in Europe; and two large international banks in Africa and Mexico. “These attacks come directly on the heels of an extensive and well-planned drive-by-download campaign, which was launched in late December. This malicious campaign’s sole purpose is to infect business professionals’ computer systems with the … ransomware, the Gootkit banking trojan or the Cobalt Strike intrusion tool,” said Rob McLeod, senior director of eSentire’s Threat Response Unit. According to researchers, the cybercriminals posted on underground forums the documents which supposedly were from these organizations’ computer systems, including partial customer lists, customer quotes, company computer file directories and contract copies.
Jill Aitoro

SC Media Editor in Chief Jill Aitoro has 20 years of experience editing and reporting on technology, business and policy. She also serves as editorial director at SC Media’s parent company, CyberRisk Alliance. Prior to joining CRA, she worked at Sightline Media as editor of Defense News and executive editor of the Business-to-Government Group. She previously worked at Washington Business Journal and Nextgov, covering federal technology, contracting and policy, as well as CMP Media’s VARBusiness and CRN and Penton Media’s iSeries News.

prestitial ad