New REvil Version Identified

Product Serial: F-2022-05-13a

TLP: WHITE

After halting all public activity in October 2021, REvil appears to have resumed operations in April 2022. ZeroFox has observed multiple updates to REvil’s leak site since then, with five new victims appearing since the site came back online, including Unicity International, U.S.-based manufacturer of wellness supplements, and Ludwig Freytag Group, a Germany-based construction company.

Standing Intelligence Requirements

DDW MAL

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

View the full report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 2:00 PM (EDT) on May 13, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Key Findings

Updated samples indicate REvil or someone close to the group has resumed operations.
REvil joins a growing list of ransom families requiring predetermined command line arguments to function.
REvil no longer refuses to run based on an infected systems’ language.
An unused configuration element introduced previously is now populated with credentials.