REvil Ransomware - what it is, how attacks unfold, and how to prevent and respond

REvil Ransomware

What it is

REvil is a high-impact ransomware family run as ransomware-as-a-service (RaaS). The core crew builds the malware and portal, while affiliates break in, steal data, and deploy the encryptor; profits are split between them. REvil uses “double extortion” - it locks files and threatens to leak stolen data to force payment - and it spreads quickly across shared drives and backups. Background and case studies: https://gridinsoft.com/blogs/tag/revil-ransomware/

Why it matters

One foothold can halt operations, expose sensitive data, and trigger breach notifications. Paying is risky, can encourage repeat targeting, and still may not recover everything.

How it works - quick tour

  • Entry: phishing, vulnerable VPN/RDP, or exploited apps.

  • Prep: disables defenses, enumerates the network, and steals data first.

  • Impact: kills backups/shadow copies, encrypts files/shares, drops notes.

  • Extort: posts proofs on a leak site and sets a crypto payment deadline.

Red flags

  • Sudden shadow-copy deletions and backup failures.

  • New admin accounts or PsExec/mini-RDP usage across hosts.

  • Many files renamed with a uniform extension plus ransom notes everywhere.

  • Outbound traffic to unfamiliar TOR/proxy endpoints during the event.

Prevent it

  • Patch exposed services fast; disable or lock down RDP and enforce phishing-resistant MFA.

  • Segment networks and use least privilege to slow lateral movement.

  • Keep 3-2-1 backups with an offline copy; test restores regularly.

  • Block macros from the internet; restrict script interpreters; deploy EDR with ransomware behavior blocks.

  • Practice an incident playbook (isolate, preserve logs, notify, restore from clean backups).

    Glossary (A–Z)

    All A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

      • Related Articles

      • Clop Ransomware

        What it is Clop is big-game ransomware: attackers break into a network, encrypt files, and demand payment to unlock them—often with data theft first to pressure victims (double extortion). It mostly targets Windows environments and larger ...

      • CryptoLocker Ransomware

        What it is CryptoLocker is ransomware that breaks into a Windows PC, hunts for documents (on the computer and connected drives), encrypts them with strong keys, and then demands a payment to unlock your files. You’ll see a ransom note saying your ...

      • BabLock Ransomware

        What it is (in plain words): BabLock is ransomware that breaks into Windows and Linux systems, scrambles (encrypts) your files, and demands payment to unlock them. It typically goes after small and mid-size businesses where one infected PC can ...

      • Djvu (STOP) Ransomware

        What it is Djvu - also called STOP - is ransomware that breaks into Windows PCs, encrypts your files, and adds new extensions (often .djvu, .stop, or a variant). A note then demands payment in crypto to unlock them. For details and removal tips, see ...

      • Cerber Ransomware

        What it is Cerber is ransomware run like a business (“RaaS”). The operators rent the malware to affiliates, who break in, encrypt files, and demand payment—then share the profits with Cerber’s creators. How it spreads Phishing emails with ...