Loading story…
Reveton ransomware spread through drive-by downloads, compromised websites, malvertising, spam, fake software downloads, and secondary delivery by existing botnets, while posing as law-enforcement agencies such as the FBI to demand fraudulent fines for alleged child pornography or piracy violations. Reporting on the operation said the malware was frequently delivered via exploit kits including BlackHole, often alongside the Citadel banking Trojan, and that some variants also stole stored passwords in addition to locking victims' systems.
The campaign relied on a broader criminal ecosystem built to maximize infections and evade disruption, including traffers, redirectors, reverse proxies, traffic direction systems, fake websites, domain rotation, fast-flux hosting, DGAs, crypting services, AV-check services, and underground advertising platforms. Researchers and law enforcement described the scheme as highly profitable, generating tens of thousands of euros per day across multiple countries, and warned that remediation often required full system reinstallation because the visible ransomware screen could mask additional malware on the infected host.
TTPs, infrastructure, and targeting history in one profile.
7 events from the most recent confirmed update back to the earliest known activity.
A second statistics page cited by researchers showed the attackers earned €43,750 on the day after May 17, 2012. The data illustrated rapid day-to-day revenue from the ransomware campaign.
Statistics from a ransomware operation showed that 322 victims across all targeted countries paid on May 17, 2012, generating more than €28,000 for the attackers. The figures were cited as evidence of the profitability of Reveton-style police-themed ransomware scams.
Analysis of the ransomware ecosystem described how compromised sites, malvertising, spam, fake downloads, and botnet tasking were used to feed victims into redirectors, traffic direction systems, and exploit kits such as Blackhole, Redkit, and Cool. The piece also documented supporting criminal services including crypting, AV-checking, domain rotation, and traffic brokering.
The analysis noted that a new infection vector appeared in early 2013 in which attackers brute-forced Remote Desktop Protocol access to Windows servers and then deployed crypto-ransomware. This marked an expansion beyond web- and botnet-driven delivery methods.
The Reveton ransomware scams had previously targeted European users before the wave that spoofed FBI notices in the United States. The campaign localized fake law-enforcement messages based on victims' countries.
Researchers gained access to one of the three main BlackHole exploit panels used by a Reveton malware gang. The panel showed more than 187,000 potential victims in a single day and over 11,000 successful Reveton infections, with outdated Java as the leading infection vector.
The FBI warned that online extortion scams impersonating the FBI had surged, with victims' computers locked until a fake fine was paid. The Internet Crime Complaint Center said it was inundated with complaints tied to the campaign.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
REvil, also known as Sodinokibi and tracked by some researchers as **GOLD SOUTHFIELD**, evolved into one of the most consequential ransomware-as-a-service operations by combining aggressive affiliate-driven intrusions with increasingly sophisticated extortion. Reporting tied the group to multiple access methods including RDP brute force, spam, watering-hole compromises, malvertising, unpatched VPN and RDP systems, and malware such as **IcedID** and **Qakbot**. Researchers also documented how REvil’s malware and ecosystem were reused or repurposed: Secureworks assessed that **LV ransomware** was a modified REvil 2.03 beta with a replaced configuration, while separate reporting linked REvil’s rise to the vacuum left by **GandCrab** and described its shift toward leak-site pressure, targeted credential fields, affiliate tracking, and removal of geographic execution restrictions in later samples. The operation’s most damaging campaign exploited multiple zero-day vulnerabilities in **Kaseya VSA**, abusing the platform’s auto-update mechanism to push ransomware through managed service providers and impact an estimated **1,500 downstream organizations**. Victims included Swedish retailers and dozens of customers served by affected MSPs, prompting Kaseya to shut down SaaS VSA, advise customers to take internet-exposed on-premises servers offline, and work with the FBI. After law-enforcement disruption and arrests, researchers reported revived REvil Tor infrastructure and newly compiled samples in 2022 that appeared to come from source code rather than recycled binaries, with updated keys, payment domains, victim-specific account targeting, and evidence of active development despite one buggy build that renamed files without encrypting them.
Aug 15, 2026
Ransomware operators behind **REvil/Sodinokibi** and **DoppelPaymer** increasingly ran intrusions like targeted espionage campaigns, combining long dwell times, privilege escalation, lateral movement, data theft, and enterprise-wide encryption. Research from Mandiant, Secureworks, JPCERT/JSAC, and CERT-FR describes attackers gaining entry through exposed **RDP** and **VPN** services, phishing-delivered malware such as **QAKBOT**, **Emotet**, and **Dridex**, brute force, and exploitation of internet-facing systems, then expanding control with tools including **Mimikatz**, **BloodHound**, **PsExec**, **WMI**, **Cobalt Strike**, and **Empire**. In many cases, affiliates or partner crews obtained domain administrator access, tampered with backups and security tools, abused Active Directory group policy and scheduled tasks, and used open SMB shares or administrative utilities to push ransomware across networks. REvil also helped normalize **double extortion** by stealing data before encryption, threatening public leaks, and in some cases publishing victim files or warning that stolen information could be sold or used to pressure public companies through market disclosure. Reporting on Sodinokibi showed the gang first releasing allegedly stolen victim data after nonpayment and later promoting leak-site tactics as a standard coercion method, while Sophos observed exfiltration in roughly half of investigated REvil incidents, often staging data in **Mega.nz**. Separate reporting said REvil’s operators secretly retained a master decryption capability and allegedly hijacked affiliate negotiations, underscoring how ransomware-as-a-service groups maintained centralized control even as affiliates conducted the intrusions.
Aug 15, 2026
The **REvil/Sodinokibi** ransomware operation broadened its playbook by combining network-wide encryption with data theft, public leak threats, and dark-web auctions of stolen files. The gang threatened to publish or sell data taken from victims including **GEDIA Automotive Group** and other unnamed companies, sometimes releasing samples such as an Active Directory **AdRecon** report or promising daily disclosures of employee and financial records. REvil also launched an auction site to monetize stolen data from non-paying victims, with opening bids such as **$50,000** in **Monero**, extending the pressure tactics already used in high-profile corporate extortion cases. Intrusions tied to REvil also showed increasingly targeted post-compromise activity. Symantec observed attackers using **Cobalt Strike**, PowerShell, remote access tools, and account creation to move laterally, disable defenses, and deploy ransomware, while also scanning some victim networks for **point-of-sale software** that could enable payment-card theft or prioritize systems for encryption. Reported victims included a New York airport, a New Jersey synagogue, and organizations in services, food, and healthcare, while Microsoft said human-operated ransomware crews were exploiting exposed **RDP**, vulnerable internet-facing systems, and flaws such as **`CVE-2019-19781`** and **`CVE-2019-11510`** before spending weeks or months inside networks prior to encryption.
Aug 15, 2026