Content by Mathew J. Schwartz

REvil's Cybercrime Reputation in Tatters - Will It Reboot?

Mathew J. Schwartz  •  October 27, 2021

Will the notorious ransomware operation known as REvil, aka Sodinokibi, reboot yet again after someone apparently messed with its infrastructure? Experts suggest that the operation's brand is burned, and administrators will launch a new group. Many affiliates, meanwhile, already work with multiple groups.

Forget Hacking Back: Just Waste Ransomware Gangs' Time

Mathew J. Schwartz  •  October 26, 2021

Who's been launching distributed denial-of-service attacks against ransomware operators' sites and cybercrime markets? Disrupting ransomware operations that rely on Tor-based data leak sites and payment portals for double extortion is an obvious move for cutting into their profits.

Memo to Ransomware Victims: Seeking Help May Save You Money

Mathew J. Schwartz  •  October 25, 2021

While ransomware might be today's top cybercrime boogeyman, attackers aren't infallible. The latest example: Errors in DarkSide - and its BlackMatter rebrand - enabled security experts to quietly decrypt many victims' files for free, saving millions in potential ransom payments.

REvil Revelations: Law Enforcement Behind Disruptions

Mathew J. Schwartz  •  October 22, 2021

The outages of the notorious REvil - aka Sodinokibi - ransomware operation have been due to a coordinated law enforcement effort involving the U.S. and foreign partners, aimed at disrupting the group's attack capabilities, Reuters reports.

Ransomware: Average Ransom Payment Stays Steady at $140,000

Mathew J. Schwartz  •  October 21, 2021

When a business, government agency or other organization hit by ransomware opted to pay a ransom to its attacker in Q3, the average payment was $140,000, reports ransomware incident response firm Coveware. It says the attack landscape has seen some notable shifts since the Colonial Pipeline attack.

Ransomware Soap Opera Continues With REvil’s Latest Outage

Mathew J. Schwartz  •  October 20, 2021

Is there any bigger cybercrime soap opera than the life and times of ransomware operators? Take the REvil, aka Sodinokibi, ransomware-as-a-service operation, which feels like it's disappeared and reappeared more times than the secret, identical twin of the protagonist in your favorite melodrama.

BlackMatter Ransomware Defense: Just-In-Time Admin Access

Mathew J. Schwartz  •  October 19, 2021

How many ways do U.S. businesses need to be told to lock down their systems to safeguard themselves from ransomware? That's the focus of a new, joint cybersecurity advisory from the U.S. government pertaining to BlackMatter, following an advisory issued last month about Conti.

Accenture: Ransomware Attack Breached Proprietary Data

Mathew J. Schwartz  •  October 18, 2021

Accenture says an online attack against it that it first disclosed in August resulted in "the extraction of proprietary information by a third party, some of which was made available to the public by the third party." The LockBit 2.0 ransomware operation has taken credit for the attack and dumping data.

BlackByte: Free Decryptor Released for Ransomware Strain

Mathew J. Schwartz  •  October 15, 2021

A free decryptor for BlackByte ransomware has been released by security researchers at Trustwave who cracked the crypto-locking malware's encryption. But they say that unfortunately, the underlying encryption problem is likely in the process of already being fixed by the malware's developer.

To Repel Supply Chain Attacks, Better Incentives Needed

Mathew J. Schwartz  •  October 14, 2021

The breach of text message routing giant Syniverse revealed yet another supply chain attack involving a key supplier, exacerbated by outdated communications protocols desperately in need of a security revamp and better incentives for improvement, says mobile telephony security expert Karsten Nohl.

Ransomware: No Decline in Victims Posted to Data Leak Sites

Mathew J. Schwartz  •  October 12, 2021

One measure of the damage being done by ransomware groups continues to be how many victims get listed on ransomware operators' dedicated data leak sites, as part of their so-called double extortion tactics. Unfortunately, the number of victims doesn't appear to be declining.

How Ransomware Attackers Hit Virtual Machine Hypervisors

Mathew J. Schwartz  •  October 5, 2021

Hypervisors under fire: BlackMatter, HelloKitty and REvil are among the ransomware groups targeting instances of VMware's ESXi. In one case investigated by security firm Sophos, after first accessing a TeamViewer account, attackers left an organization's ESXi environment crypto-locked just three hours later.

Ukraine Busts 2 Suspects Tied to Major Ransomware Group

Mathew J. Schwartz  •  October 4, 2021

Police in Ukraine have arrested two members of a ransomware operation they say has targeted businesses in North American and Europe, leading to victim losses totaling at least $150 million. The operation also involved French cyber police, the FBI and Interpol, backed by Europol's European Cybercrime Center.

Ransomware Patch or Perish: Attackers Exploit ColdFusion

Mathew J. Schwartz  •  September 27, 2021

For combating ransomware, doing the security basics is essential, including keeping systems updated and patched. Don't follow in the footsteps of one technology firm, which Sophos found got hit by Cring ransomware after attackers exploited ColdFusion software that hadn't been patched in 11 years.

REvil Ransomware Group's Latest Victim: Its Own Affiliates

Mathew J. Schwartz  •  September 25, 2021

Ransomware-wielding attackers love to lie to victims. But REvil - aka Sodinokibi - has reportedly been running double negotiations to make affiliates think a victim hasn't paid a ransom, using a backdoor in the malware that allows administrators to decrypt victims' systems, so affiliates don't get their cut.