Loading story…
A mid-sized media company was hit by a REvil ransomware intrusion in which attackers compromised accounts, deployed Cobalt Strike, and installed ScreenConnect on roughly 130 endpoints to maintain persistence and remote access. During the attack, the intruders stole domain administrator credentials and created their own domain admin account, escalating control across the environment before launching ransomware and demanding $2.5 million.
The incident was contained during a live response effort involving the company’s IT team and Sophos Rapid Response, preventing a full operational shutdown, but the attackers still encrypted data on unprotected devices, deleted online backups, and destroyed a previously air-gapped domain after it had been connected to the internet. The case underscored how uneven endpoint protection, exposed or newly connected systems, and limited visibility into unmanaged assets can allow ransomware operators to expand quickly inside a network.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
By the second day of the incident, only intermittent inbound attacks were still being detected and the main attack attempt had ended. The attack failed to fully cripple the company, and the ransom was not paid.
Despite containment efforts, the attackers encrypted data on unprotected devices, deleted the company’s online backups, and destroyed an online undefended domain that had previously been air-gapped. The damage was mainly limited to unprotected devices and domains.
The company’s IT team and Sophos Rapid Response engaged the attackers in a live response effort lasting about four hours during the main attack phase. Sophos CryptoGuard blocked some remote encryption attempts, but attackers repeatedly relaunched encryption from different compromised unprotected devices.
A few hours after the initial Cobalt Strike detection, at about 4 a.m. local time, the attackers deployed REvil ransomware. The ransom note demanded $2.5 million.
During the intrusion, the attackers installed ScreenConnect on 130 endpoints for persistence, stole domain administrator credentials, and created their own domain admin account. They also moved laterally through unprotected computers and maintained access across the environment.
In early June 2021, a mid-sized media company detected Cobalt Strike activity on its network, marking the start of the incident described in the source. Attackers had already compromised multiple accounts by this stage, including an IT staff account.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **REvil/Sodinokibi** ransomware operation broadened its playbook by combining network-wide encryption with data theft, public leak threats, and dark-web auctions of stolen files. The gang threatened to publish or sell data taken from victims including **GEDIA Automotive Group** and other unnamed companies, sometimes releasing samples such as an Active Directory **AdRecon** report or promising daily disclosures of employee and financial records. REvil also launched an auction site to monetize stolen data from non-paying victims, with opening bids such as **$50,000** in **Monero**, extending the pressure tactics already used in high-profile corporate extortion cases. Intrusions tied to REvil also showed increasingly targeted post-compromise activity. Symantec observed attackers using **Cobalt Strike**, PowerShell, remote access tools, and account creation to move laterally, disable defenses, and deploy ransomware, while also scanning some victim networks for **point-of-sale software** that could enable payment-card theft or prioritize systems for encryption. Reported victims included a New York airport, a New Jersey synagogue, and organizations in services, food, and healthcare, while Microsoft said human-operated ransomware crews were exploiting exposed **RDP**, vulnerable internet-facing systems, and flaws such as **`CVE-2019-19781`** and **`CVE-2019-11510`** before spending weeks or months inside networks prior to encryption.
Aug 15, 2026
REvil affiliates exploited four zero-day flaws in on-premises **Kaseya VSA** servers to turn a trusted remote management platform into a ransomware delivery channel for managed service providers and their customers. The attack chain reportedly included an authentication bypass, unrestricted file upload, CSRF bypass, and command injection, allowing attackers to upload malicious ASP code and push ransomware through VSA with administrator-level access. Researchers said the campaign abused Kaseya-mandated antivirus exclusions, used `agentmon.exe` to launch malicious commands, decoded payloads with a renamed `certutil`, and side-loaded a malicious DLL through a signed dropper and an outdated Microsoft Defender binary while disabling multiple Defender protections. The supply-chain attack encrypted local, removable, and mapped network drives across downstream environments, affecting about **60 MSPs** and roughly **1,500 businesses**, though REvil claimed a far larger device count and demanded **$70 million** for a universal decryptor. Red Canary said it detected the activity before the vulnerabilities were publicly known by spotting behavioral indicators such as Defender tampering and registry changes tied to REvil, then used containment actions including endpoint isolation and hash banning across multiple customer environments. Kaseya later patched the flaws in version `9.5.7a` and subsequently obtained a universal decryptor from a trusted third party, which it distributed to victims as the FBI and DOJ continued investigating the incident.
Aug 15, 2026
A major global equipment manufacturer suffered a severe ransomware attack orchestrated by the BlackSuit ransomware group, also known as Ignoble Scorpius. The attack began with a vishing (voice phishing) campaign in which an attacker impersonated the company's IT help desk and convinced an employee to enter their VPN credentials into a phishing site. Using these stolen credentials, the attackers gained initial access to the corporate network. Once inside, they escalated privileges by executing a DCSync attack on a domain controller, allowing them to steal highly privileged credentials, including those of a key service account. The attackers then moved laterally across the network using Remote Desktop Protocol (RDP), Server Message Block (SMB), and tools such as Advanced IP Scanner and SMBExec to map the environment and identify valuable assets. Persistence was established by deploying AnyDesk and a custom remote access trojan (RAT) as scheduled tasks on domain controllers. The threat actors compromised a second domain controller and extracted the NTDS.dit database, which contains all user password hashes, enabling further credential compromise. Over 400 GB of sensitive data was exfiltrated using a renamed rclone utility. To erase forensic evidence and hinder incident response, the attackers deployed CCleaner before launching the ransomware payload. The BlackSuit ransomware was deployed using Ansible, resulting in the simultaneous encryption of hundreds of virtual machines across nearly 60 VMware ESXi hosts, causing widespread operational disruption. The attackers demanded a $20 million ransom, which the organization refused to pay. In response, the manufacturer implemented several security measures, including upgrading to newer Cisco Adaptive Security Appliance firewalls, enforcing multi-factor authentication, segmenting the network, deactivating NTLM, and restricting administrative access to isolated VLANs. The incident highlights the significant risks posed by social engineering and credential theft, as well as the sophisticated tactics used by modern ransomware groups. The attack demonstrates the importance of robust incident response, credential hygiene, and layered security controls to mitigate the impact of such breaches. The use of legitimate remote access tools and living-off-the-land techniques by the attackers complicated detection and response efforts. The exfiltration of large volumes of sensitive data prior to encryption underscores the dual extortion tactics now common among ransomware operators. The manufacturer’s refusal to pay the ransom and rapid implementation of enhanced security controls serve as a case study in post-incident resilience. The attack also illustrates the growing trend of targeting virtualization infrastructure, such as VMware ESXi hosts, to maximize operational disruption. Security researchers and incident responders continue to analyze the tactics, techniques, and procedures (TTPs) used in this attack to inform defensive strategies for other organizations.
Jun 29, 2026