Loading story…
Open-source intelligence research has identified the cybercrime forum persona Quake3—described as an XSS moderator—and the alias morgot as the same individual allegedly involved in developing the REvil ransomware source code. The reporting says multiple forum accounts were operated from the same two IP addresses, during matching hours, across three consecutive months, and that one of the linked accounts belonged to a moderator on exploit.in.
The attribution case also cites private correspondence in which the individual allegedly acknowledged being morgot on exploit.in, along with repeated use of the Jabber handle morgot@exploit.im over a six-year period. Additional reporting says a DEF CON 33 persona mapping connected the aliases morgot, Rcode, and Quake3 to the REvil source-code developer, strengthening an OSINT-based attribution built on IP overlap, timing patterns, pseudonym reuse, and cross-platform identity correlations.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
VULONE published an OSINT attribution analysis arguing that a single individual behind the aliases morgot, Rcode, and Quake3 was linked to development of the REvil ransomware source code. The report said the case relied on correlations including shared IP addresses, overlapping usage times, pseudonyms, and private correspondence.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A leaked historical archive of the Russian-language cybercrime forum Exploit.in, covering February 2005 to May 2008, documents early structures that foreshadowed the modern ransomware economy. The dataset contains 9,647 accounts, 13,925 threads, and 80,891 posts, with a small group of prolific members driving much of the activity. Its private access levels, reputation mechanisms, and trade in compromised shells and network access resemble present-day affiliate vetting, escrow arrangements, and initial-access-broker markets. Researcher Dancho Danchev identified 205 distinctive handles appearing both on Exploit.in and in private-message archives from five later criminal forums, including XSS, RAMP, and BreachForums, indicating possible long-term social and operational continuity. The evidence does not establish that identically named accounts belonged to the same individuals, and identities were not published because the archive contains sensitive personal information for thousands of users.
Sep 28, 2026
REvil, also known as Sodinokibi and tracked by some researchers as **GOLD SOUTHFIELD**, evolved into one of the most consequential ransomware-as-a-service operations by combining aggressive affiliate-driven intrusions with increasingly sophisticated extortion. Reporting tied the group to multiple access methods including RDP brute force, spam, watering-hole compromises, malvertising, unpatched VPN and RDP systems, and malware such as **IcedID** and **Qakbot**. Researchers also documented how REvil’s malware and ecosystem were reused or repurposed: Secureworks assessed that **LV ransomware** was a modified REvil 2.03 beta with a replaced configuration, while separate reporting linked REvil’s rise to the vacuum left by **GandCrab** and described its shift toward leak-site pressure, targeted credential fields, affiliate tracking, and removal of geographic execution restrictions in later samples. The operation’s most damaging campaign exploited multiple zero-day vulnerabilities in **Kaseya VSA**, abusing the platform’s auto-update mechanism to push ransomware through managed service providers and impact an estimated **1,500 downstream organizations**. Victims included Swedish retailers and dozens of customers served by affected MSPs, prompting Kaseya to shut down SaaS VSA, advise customers to take internet-exposed on-premises servers offline, and work with the FBI. After law-enforcement disruption and arrests, researchers reported revived REvil Tor infrastructure and newly compiled samples in 2022 that appeared to come from source code rather than recycled binaries, with updated keys, payment domains, victim-specific account targeting, and evidence of active development despite one buggy build that renamed files without encrypting them.
Aug 15, 2026
Investigators tied **IcedID** (also known as **Bokbot**) command-and-control infrastructure to ransomware intrusions in which the malware served as an initial access foothold later used by **Sodinokibi/REvil** operators. In one documented compromise, a malspam-delivered XLSM macro launched IcedID through `WMIC` and `regsvr32`, after which attackers established persistence, deployed **Cobalt Strike**, moved laterally across the Windows domain, escalated to Domain Administrator, and dumped credentials from `LSASS`. The intrusion also involved Exchange server pivoting, SMB and PowerShell-based lateral movement, Active Directory discovery with techniques consistent with **BloodHound**, and additional enumeration using **AdFind** and `ping`. Before encrypting systems, the attackers used **Rclone** disguised as `svchost.exe` to exfiltrate data for double extortion, then pushed REvil ransomware from a domain controller with **BITSAdmin** and executed it with the `-smode` option to reboot hosts into Safe Mode with Networking, helping disable security and management tools; all domain-joined systems were encrypted in about 4.5 hours. Building on indicators from that case, researchers used passive DNS and infrastructure-pattern analysis to identify a broader IcedID cluster characterized by recurring domain registration and hosting behavior, including Porkbun registrations, later migration to Cloudflare name servers, and shared hosting across IPs such as `206.189.10.247`, `161.35.109.168`, `143.198.25.214`, and `83.97.20.176`, ultimately mapping **58 IP addresses** and **323 domains** believed to support IcedID operations.
Aug 15, 2026