Ransom Cartel ransomware-as-a-service operator blog claims to offer a new and improved version of REvil ransomware.

Dark Reading Staff, Dark Reading

October 17, 2022

1 Min Read
Image of a laptop with police tape around it, signifying a cybercrime attack
Source: Andreas Prott via Alamy

Although the REvil ransomware-as-a-service operation appeared to evaporate last October, analysts have found the group's influence is still considerable. 

Notably, threat researchers from Unit 42 reported finding connections between REvil activities and that of ransomware group Ransom Cartel, an up-and-coming cybercrime group claiming to offer "the same, yet improved software" as REvil. 

Following analysis, the Unit 42 team determined Ransom Cartel somehow was able to gain access to REvil ransomware source code. Ransom Cartel also mimics REvil tactics, including double extortion, Unit 42 added. However, the researchers said there are some aspects of the REvil operation that Ransom Cartel seems to lack. 

"Based on the fact that the Ransom Cartel operators clearly have access to the original REvil ransomware source code, yet likely do not possess the obfuscation engine used to encrypt strings and hide API calls," the Unit 42 ransomware report explained, "we speculate that the operators of Ransom Cartel had a relationship with the REvil group at one point, before starting their own operation."

About the Author(s)

Dark Reading Staff

Dark Reading

Dark Reading is a leading cybersecurity media site.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like

More Insights