REvil, the Russian-linked hacker group the FBI said is responsible for the cyberattack on JBS SA, the largest meat producer in the world, has emerged as one of the most prolific and public ransomware groups in recent years.
The hackers, also known as Sodinokibi, have been at the forefront of the ransomware-as-a-service model of cyberattacks since the group first came to prominence as a security threat in 2019. In this model, hacker groups provide malware for others to use in an attack in exchange for a cut of the ransom payments. In order to recruit talent, REvil deposited $1 million in Bitcoin as a way to give potential affiliates peace of mind that they would get paid.
REvil, the Russian-linked hacker group the FBI said is responsible for the cyberattack on JBS SA, the largest meat producer in the world, has emerged as one of the most prolific and public ransomware groups in recent years.
DiMaggio’s study is a broad examination of attacks in recent months, examining the goals, practices and payoffs of what he calls the world’s first ransom cartel’. AFP Relaxnews
One gang of cybercriminals extorted at least US$75mil (RM309.86mil) from private sector companies, local governments and hospitals, a former NSA contractor concluded in a months-long study released on April 7, an alarming sign of the potential financial rewards for online attacks.
Jon DiMaggio, the chief security strategist at Virginia-based Analyst1, estimated the group known as Twisted Spider used the Egregor ransomware to extract at least that amount from his targets, according to publicly acknowledged ransom payments. He believes the real number is much higher, because “many victims never publicly report when they pay a ransom” and the “bad guys don’t post their stuff online”.