September 13, 2021

REvil Ransomware gang has returned to attack new victims, while also posting stolen files on a data leak website.

Their reemergence comes almost two months after shutting down their infrastructure following a massive attack in which the gang exploited a zero-day vulnerability in the Kaseya VSA remote management platform.

While the gang’s Tor payment / negotiation and data leak page suddenly made accessible on September 7, evidence of new attacks first appeared on September 9, when an annonymous user reported a new REvil Ransomware profile compiled on September 4 on VirusTotal, and screenshots of stolen data from a new victim on their data leak page a few hours earlier.

A new representative named ‘REvil’ has also emerged, explaining in a hacker forum what led to the gang’s short-term shutdown. The user also suggested that the former REvil representative, known as ‘Unknown’ or ‘UNKN’ and posted on behalf of the group, had been replaced.

For more information, read the original story in Bleeping Computer.