We have recently seen reports that the REvil ransomware gang has returned to the Internet after the January 2022 arrests of several of its members by Russian authorities for allegedly dismantling the group and arresting two members in November 2021 by US authorities. While it remains to be seen whether the re-emergence of REvil includes its more aggressive members with the same tech skills or is just a copycat group raising the old name and bits of infrastructure, we’ve seen a steady stream of new REvil duos out in the wild. Currently our main hypothesis is that one or more individuals have gained control of the old REvil Happy blog and some binary source code. It’s important to note that REvil was actually a rebrand of GandCrab to gain influence and interest, so it’s worth noting that the REvil name, due to notoriety, is being used again/still. This gives us reason to believe that the original core members of the REvil group are most likely not involved.
However, re-emergence or not, it is in our interest.
The Threat Intelligence Group of the Trellix Advanced Research Center studied REvil, its predecessor, GandCrab, and other representatives like them. In this blog, we’ll often refer to the research we’ve done in the past on both GandCrab and REvil. For those interested in our previous research check out the following blogs:
Gandcrab:
Virus Bulletin 2019: Different Ways to Cook Crab: A GandCrab Ransomware-as-a-Serive (RaaS) Analysis
Revel
Episode 1: What does the code tell us
Episode 2: Allstars
Episode 3: Follow the money
Episode 4: Cresendo
To defend against cybercriminals, we must understand how they think and how they operate. To end the operations of the Cybercriminal Foundation, or the ransomware process in this case, the individual or group responsible for a cyber attack must be discovered and prosecuted, but it can be very difficult for law enforcement to identify the affiliated members behind the attacks.
In the lead-up to the FBI’s seizure of funds stolen by REvil and the indictments and arrests of some members of the group, Trellix described a new method for enumerating members of the major ransomware gang. We have described this extensively in our VB2019 post on GandCrab and previous REvil blog. In this blog, we will take you all the way from the steps REvil took to build the cybercriminals project through the gaffes that ultimately led to their downfall.
Building a cyber crime project
Our team’s research on Conte reiterated much of what we learned from our study of REvil. Groups of cybercriminals are growing in their sophistication and operations, building everything from human resources, to payroll, to culture and employee recognition software, to call centers. They are fully functional enterprises, with marketing and user support. As they expand and build trust and dependence in others, they often open doors for researchers and law enforcement to create loopholes in their processes and technologies that could provide new ways to detect exactly which members they are affiliated with.
Figure 1: A segment of inbound marketing showing the brand and vision to attract talent by GandCrab ransomware, the predecessor of Revil.
When we think about the “empire” of cybercrime, here are the main components we can expect to notice in the wild:
1. A stable product: For a group to be successful, it must have an easy-to-use and stable malware, and in the case of ransomware, a more stable decryption software.
2. Technology and Mass Marketing: Many ransomware groups and other cybercriminal gangs are promoting their activities, mission and job postings on carefully curated dark web sites which are used to instill fear in potential victims/victims. The way an organization defines itself is critical to attracting and retaining affiliate members. To scale up the ransomware-as-a-Service (RaaS) suite, we often see groups deploying a central panel to communicate with victims, request binaries, and decrypt, rather than negotiating via email with hundreds of victims at any given moment.
3. The right people: It is important to hire the most talented affiliates, but as with many companies, many groups will still require members to complete trial periods to prove they are a good fit.
4. Strategic Partnerships: To expand even further, cybercriminal groups are taking advantage of partnerships to carry out their areas of business – everywhere from malware obfuscation services to call centers to Bitcoin laundering services. This allows the group to focus on their specialty.
5. Pay off your debts: Loyalty is perhaps the most important factor in keeping a cybercriminal group operating. Malware authors made it easier for management to know what they owed by creating a tracking mechanism to assign commissions across the team responsible for the attack.
Organized signs are often seen on the brink of fall when they forget to stay humble, loyalty goes out the window, or they make a dirty mistake. The growth of infrastructure, processes, and human capital means the growth of opportunities for chaos and the greater likelihood that investigators like us will find new ways to study it.
Figure 2: Announcing the partnership of a popular malware hiding service with GandCrab Ransomware. Details that its users receive a great discount for using these specific services.
REvil in action
REvil first appeared in the wild as Sodinokibi at the end of April 2019. Spinning off from the GandCrab group, Sodinokibi aka REvil, the group quickly established its operations, building a sizable RaaS empire responsible for millions of dollars in stealing across countries and some of the most significant ransomware attacks in modern history. RaaS groups work with a core group of people who hold the code and another group, known as affiliates, that spreads ransomware. Additional support functionality and partners are key to operations, and it is common for RaaS groups to earn commission on ransoms collected from victims. However, there were also groups like the Conti Group that instead of paying a percentage, their affiliates had payroll.
The article was written by John Focker and submitted by Caitlin Robertson to TechBooky. John Focker is Head of Threat Intelligence and Principal Architect at Trellix