Reveton

Reveton is a ransomware family, widely known as FBI MoneyPak ransomware, that combines locker ransomware and scareware behavior. It locks victims out of their systems and displays fake law-enforcement warnings claiming the device was used for illegal activity such as child pornography, copyright infringement, terrorism, gambling, or other offenses. The lock screen commonly impersonates agencies such as the FBI, Department of Justice, or local police, may display the victim’s IP address, and some variants can activate or display an image from the victim’s webcam to increase credibility. Reveton demanded payment as a supposed “fine” to restore access, with reported payment methods including GreenDot MoneyPak prepaid cards and Paysafecard, and reported ransom amounts ranging from about $100 to $1,000, including commonly cited demands of $200.

The malware was delivered through compromised websites, drive-by infections, malvertising, and exploit kits. Multiple sources in the content state that victims could be infected after visiting compromised sites, including campaigns using the Angler exploit kit and exploitation of browser vulnerabilities such as Adobe Flash CVE-2015-0311. Reveton was also described as being delivered by Citadel malware. The content notes large malvertising campaigns that delivered either Reveton or Bedep.

Reveton is repeatedly described as an early and significant ransomware family and is identified in the content as the first reported ransomware-as-a-service offering, enabling less technically skilled criminals to rent or purchase access. It is associated in the content with the “FBI MoneyPak” branding and with criminal operators tied to malvertising and exploit-kit ecosystems. The content references overlap between Reveton distributors and the DNSChanger/Nelicash ecosystem, links to the Reveton team in historical discussions around Angler exploit kit usage, and notes law-enforcement action against individuals involved in creating or distributing Reveton, including UK NCA-led arrests and U.S. prosecutions tied to laundering ransom proceeds.

Targeting was broad and included home users, with campaigns observed in the United States and internationally. The content specifically mentions fake warnings purporting to come from the FBI, Department of Justice, and local police agencies. Known behavioral indicators from the content include immediate system lockout, fake police or FBI splash screens, accusations of illegal online activity, demands for prepaid-card payment, browser-locking via iframe loops in some variants, persistence on the infected device requiring malware removal, and in some cases webcam activation or display. Reveton also appears in historical reporting as a predecessor or point of comparison for later Delphi-based malware such as CryptXXX and DanaBot.