REvil

REvil (also known as Sodinokibi) is a private ransomware-as-a-service (RaaS) operation [1] that recruits affiliates to distribute the ransomware for them. As part of this arrangement, the affiliates and ransomware developers split revenue generated from ransom payments.[2] It is difficult to pinpoint their exact location, but they are thought to be based in Russia due to the fact that the group does not target Russian organizations, or those in former Soviet-bloc countries.[3] REvil claims its annual revenue from its RaaS operations now exceed $100 million USD.[4]

Cybersecurity experts believe REvil is an offshoot from a previous notorious, but now-defunct hacker gang, GandCrab.[5] This is suspected due to the fact that REvil first became active directly after GandCrab shutdown, and that the ransomware both employ share a significant amount of code.

As part of the criminal cybergang's operations, they are known for stealing nearly one terabyte of information from the law firm Grubman Shire Meiselas & Sacks and demanding a ransom for not publishing it.[6][7][8] The group has attempted to extort other companies and public figures as well. In May 2020 they demanded $42 million from US president Donald Trump.[9][10] The group claimed to have done this by deciphering the Elliptic-curve cryptography that the firm used to protect its data.[11] According to an interview with an alleged member, they found a buyer for Trump information, but this cannot be confirmed.[12] In the same interview, the member claims that they will bring in $100 million in ransoms in 2020.

On the 16th of May the group released legal documents totaling a size of 2.4GB related to the singer Lady Gaga.[13] The following day they released 169 "harmless" e-mails which referred to Donald Trump or contained the word 'trump'.[14]

They were planning on selling Madonna's information,[15] but eventually reneged.[16]