This cybercriminal group has created an underground auction site for stolen data
REvil ransomware group is now auctioning off stolen data
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
In an effort to further profit from their illegal activities, the operators of theREvil ransomwarehave launched a new auction site which will be used to sell stolen data from victims to the highest bidder.
REvil, which is also known asSodinokibi, is a massive ransomware operation known for breaching corporate networks though exposed remote desktop services, spam, exploits and hacked Managed Service Providers (MSPs).
After gaining access to a victim’s network, the ransomware gang spreads laterally though the company while stealing any unencrypted data available on workstations and exposed servers. Once they gain administrative access to a domain controller, REvil deploys its ransomware to encrypt all of the computers on a network.
The operators of the REvil ransomware created a data leak site called the “Happy Blog' earlier this year which the group uses to publish a victim’s data if a ransom is not paid. The site is used to post samples of stolen data in order to persuade victims to pay the group’s ransom. However, if the ransom is not paid, the stolen data is made available for free via a link so that other cybercriminals can use it for their own operations.
Underground auction site
Last month, REvil began leaking the data ofcelebrity law firm GSMLawafter a ransom was not paid. The ransomware group claimed that it hadincriminating dataabout US President Donald Trump which it was auctioning off to the highest bidder at a starting price of $1m. The group later claimed that it had sold its data on the US President and that it would auction off data about Madonna in the future.
In order to continue generating revenue from its operations, the operators of REvil have added a section dedicated to conducting online auctions to their Happy Blog site.
The group is currently auctioning off the stolen data of a US food distributor at a starting price of $100,000 but this data can be purchased outright at a “Blitz price” of $200,000. At the same time, the data of a Canadian agricultural company is also being auctioned off at a starting price of $50,000 with the option to purchase it right away for $100,000.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
To bid on an auction, bidders must agree to make a deposit of 10 percent of the starting price and if they win, they’ll have to pay the full amount in theMonerocryptocurrency. In its announcement, the REvil group also hinted that other auctions of stolen data are coming soon.
ViaBleepingComputer
After working with the TechRadar Pro team for the last several years, Anthony is now the security and networking editor at Tom’s Guide where he covers everything from data breaches and ransomware gangs to the best way to cover your whole home or business with Wi-Fi. When not writing, you can find him tinkering with PCs and game consoles, managing cables and upgrading his smart home.
A new form of macOS malware is being used by devious North Korean hackers
Scammers are using fake copyright infringement claims to hack businesses
How to turn off Meta AI
