Cybergang Claims REvil is Back, Executes DDoS Attacks

Actors claiming to be the defunct ransomware group are targeting one of Akami’s customers with a Layer 7 attack, demanding an extortion payment in Bitcoin.

The defunct REvil ransomware gang is claiming responsibility for a recent distributed denial of service (DDoS) campaign against a hospitality customer of cloud networking provider Akamai. However, it’s highly possible the attack is not a resurgence of the infamous cybercriminal group but a copycat operations, researchers said.

Akamai researchers have been monitoring the DDoS attack since May 12, when a customer an alerted the company’s Security Incident Response Team (SIRT) of an attempted attack by a group claiming to be associated with REvil, Akamai revealed in a blog post Wednesday.

“The attacks so far target a site by sending a wave of HTTP/2 GET requests with some cache-busting techniques to overwhelm the website,” Akamai SIRT vulnerability researcher Larry Cashdollar wrote in the post. “The requests contain embedded demands for payment, a bitcoin (BTC) wallet, and business/political demands.”

However, while the attackers claim to be REvil, it’s unclear at this time if the defunct ransomware group is responsible, as the attempts seem smaller than previous similar campaigns for which the group claimed responsibility, researchers said.

There also appears to be a political motivation behind the DDoS campaign, which is inconsistent with REvil’s previous tactics, in which the group claimed it was motivated solely by financial gain.

****Return of REvil?****

REvil, which went dark in July 2021, was a Russia-based ransomware-as-a-service (RaaS) group well-known for its high-profile attacks against Kaseya, JBS Foods and Apple Computer, among others. The disruptive nature of its attacks spurred international authorities to go hard against the group, with Europol arresting a number of the gang’s affiliates in November 2021.

Finally, in March 2022, Russia—which until then had done little to thwart REvil’s operation–claimed responsibility for fully dismantling the group at the request of the U.S. government, apprehending its individual members. One of those arrested at the time was instrumental in helping ransomware group DarkSide in a crippling attack in May 2021 against Colonial Pipeline, which resulted in the company paying $5 million in ransom.

The recent DDoS attack—which would be a pivot for REvil—was comprised of a simple HTTP GET request in which the request path contained a message to the target containing a 554-byte message demanding payment, researchers said. Traffic in the attack on Layer 7 of the network—the human-computer interaction layer in which apps access network services–peaked at 15 kRps.

The victim was directed to send the BTC payment to a wallet address that “currently has no history and is not tied to any previously known BTC,” Cashdollar wrote.

The attack also had an additional geospecific demand that requested the targeted company to cease business operations across an entire country, he said. Specifically, attackers threatened to launch to follow-up attack that would affect global business operations if this demand was not met and the ransom was not paid in a specific timeframe.

****Potential Copycat Attack****

There is a precedent for REvil using DDoS in its pervious tactics as a means of triple extortion. However, aside from that, the attack does not appear to be the work of the ransomware group unless it’s the start of an entirely new operation, Cashdollar noted.

REvil’s typical modus operandi was to gain access to a target network or organization and encrypt or steal sensitive data, demanding payment to decrypt or prevent information leakage to the highest bidders or threatening public disclosure of sensitive or damaging information, he said.

The technique seen in the DDoS attack “strays from their normal tactics,” Cashdollar wrote. “The REvil gang is a RaaS provider, and there is no presence of ransomware in this incident,” he wrote.

The political motivation tied to the attack—which is linked to a legal ruling about the targeted company’s business model–also goes against a claim REvil’s leaders have made in the past that they are purely profit-driven. “We haven’t seen REvil linked to political campaigns in any other previously reported attacks,” Cashdollar observed.

However, it is possible that REvil is seeking a resurgence by dipping its toe in a new business model of DDoS extortion, he said. What’s more likely is that attackers in the campaign are merely using the name of a notorious cybercriminal group to frighten the targeted organization into meeting their demands, Cashdollar said.

“What better way to scare your victim into payment than leveraging the name of a notable group that strikes fear into the hearts of organizations’ executives and security teams across wide swaths of industry,” he wrote.