Security intelligence vendor Flashpoint claims to have found forum comments from customers of the REvil ransomware-as-a-service gang, and they’re not happy. The gang's malware may contain backdoors that REvil uses to restore encrypted files itself.

REvil's modus operandi is to rent its malware to other evildoers, in return for a hefty cut of any ransoms paid by victims.

Flashpoint [1]writes that the "Exploit" forum has recently featured posts from a threat actor complaining about the backdoor, and the fact its presence meant that REvil could let its customers do all the hard work of arranging an infection, then subvert communications with victims and keep the entire ransom for itself.

[2]

Other chat in the forum, Flashpoint asserts, includes complaints about REvil's behaviour, and the futility of attempting to negotiate with the gang.

[3]

One thread seen by Flashpoint apparently features a ransomware business complaining about "lousy partner programs".

[4]Suex to be you: Feds sanction cryptocurrency exchange for handling payments from 8+ ransomware variants

[5]Confessions of a ransomware negotiator: Well, somebody's got to talk to the criminals holding data hostage

[6]Kaseya obtains REvil decryptor, starts sharing it with afflicted customers

Flashpoint has shared one screen shot [7]of chat on Exploit . The Register has translated it from the original Russian and it does appear to comprise chat about REvil's code.

But we'll have to take the firm's word for it on the content of other Russian crime forum posts, while noting that Brian Krebs [8]reported in March 2021 that three such forums were breached.

On the other hand, as the old saying goes: there is no honour among thieves. The Register would not be the least bit surprised to learn that applies to ransomware gangs, too. ®

Get our [9]Tech Resources



[1] https://www.flashpoint-intel.com/blog/revils-cryptobackdoor-con-ransomware-groups-tactics-roil-affiliates-sparking-a-fallout/

[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YVQ5YDvKq7OBFhgfoeYLXwAAAIE&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YVQ5YDvKq7OBFhgfoeYLXwAAAIE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[4] https://www.theregister.com/2021/09/21/feds_sanction_suex/

[5] https://www.theregister.com/2021/09/03/how_to_be_a_ransomware/

[6] https://www.theregister.com/2021/07/23/kaseya_obtains_revil_decryptor_starts/

[7] https://www.flashpoint-intel.com/wp-content/uploads/2021/09/Flashpoint-REvil1.png

[8] https://krebsonsecurity.com/2021/03/three-top-russian-cybercrime-forums-hacked/

[9] https://whitepapers.theregister.com/