REvil: Riches to Rags – The Rise and Takedown of a Cybercrime Empire
summary
REvil operates as a commission-based ransomware-as-a-service using Jabber and Tor backend comms, a public leak site, stable decryptors and automated payment portals tied to a BitMix.Biz tumbling API; about 40 active affiliates receive 20/80 or 30/70 splits and the campaign embeds a per-binary configuration with a pid/sub id that maps affiliate to attack. Forensics trace blockchain cashouts, law enforcement links affiliate 22 to Kaseya, arrests follow and $2.3M is seized; an internal backend panel (complete with a coin sound on payment) proves pivotal.
AI-written summary · about
chapters (13)
- 0:00Introduction to re-evil
- 0:53Operating model overview
- 2:47Affiliate structure
- 5:57Success factors for groups
- 9:38Outsourcing and logistics
- 13:53Attribution and forensics
- 17:18Financial trails
- 21:14The role of informants
- 25:03Analyzing the back end
- 28:55Law enforcement impact
- 33:33Current state of re-evil
- 35:20Lessons for defenders
- 38:25Q&A and closing
related talks
40mRansomware Threat Landscape
27mFrom RATs to Extorting Multibillion Companies: The Evolution of a Modern Ransomware Group
40mRansomware: New Recipe For An Old Dish
32mProspecting Ransomware Tech
37mRansomware Resilience: Holistic Defense for SOC Leaders
14mThe Conjuring: ransomware edition!!
41mRansomware Incident Response - The Real-World Story of a Ransomware Attack
33mLiving with Ransomware - The New Normal in Cyber Security