REvil ransomware

REvil ransomware

Inspired by the Resident Evil movie series, Ransomware Evil or REvil ransomware is a ransomware-as-a-service (RaaS) operation run by Russian cyber actors that has extorted large amounts of money from organizations worldwide over the past year.

REvil works by deploying ransomware in all computers by performing lateral movement to obtain domain administration privileges. Since REvil is distributed by different groups, the initial access vectors differ among phishing emails with malicious attachments to compromised RDP (Remote Desktop Protocol) credentials and the exploitation of vulnerabilities in various public-facing services.

Kaseya, a software enterprise that provides IT management solutions to managed service providers (MSPs), confirmed that attackers had exploited zero-day vulnerabilities in Kaseya VSA, a remote monitoring and managing product. This video explains what REvil ransomware is, how it works and ways to stay ahead of it. Watch the video to learn more, three minutes is all it takes!