Eliana Willis

Cybercriminals claiming to be part of the REvil ransomware group have alleged that the gang is closing shop after the group lost control of vital infrastructure and had internal disputes. Recorded Future security expert Dmitry Smilyanets shared multiple messages on Twitter from ‘0_neday’ — a known REvil operator — discussing what happened on the cybercriminal forum XSS. He claimed someone took control of the group’s Tor payment portal and data leak website.In the messages, 0_neday explains that he and “Unknown” — a leading representative of the group — were the only two members of the gang who had REvil’s domain keys. “Unknown” disappeared in July, leaving the other members of the group to assume he died. The group resumed operations in September but this weekend, 0_neday wrote that the REvil domain had been accessed using the keys of “Unknown.” In another message, 0_neday said, “The server was compromised and they were looking for me. To be precise, they deleted the path to my hidden service in the torrc file and raised their own so that I would go there. I checked on others — this was not. Good luck everyone, I’m off.”
Dmitry Smilyanets
REvil originally closed shop in July after the devastating attack on Kaseya infected hundreds of organizations across the world and caused untold damage. The group is one of the most prolific ransomware gangs currently operating, attacking hundreds of vital companies and organizations over the last few years. But the group attracted immense law enforcement scrutiny following the July 4 attack on Kaseya and ended its operation on July 13. By September, the group returned, continuing to attack dozens of companies in the last few weeks. According to The Record, the July 13 shut down happened because “Unknown” allegedly stole the group’s money and shut down their servers, making it difficult for those remaining to pay affiliates. 

Smilyanets told the news outlet that he hoped the group had shut down because of law enforcement actions by US officials. The FBI and other US agencies faced significant backlash over the past few weeks because of their actions during the REvil attack on Kaseya. The FBI admitted it had decryption keys that could have helped the nearly 1,500 ransomware victims affected by the Kaseya attack, but decided against it because they were preparing an operation to disrupt REvil’s infrastructure. The group closed shop before the operation could be seen through and the FBI has been harshly criticized by the organizations affected and lawmakers for waiting to hand out the decryption keys. Bitdefender later released a free decryptor for all of the organizations affected by the Kaseya attack. Opinions on the situation were mixed among experts, with some cautioning people not to believe the word of criminals. Others said the situation made sense because REvil was facing criticism from its own affiliates for their actions. Allan Liska, a ransomware expert with Recorded Future, told ZDNet that there were two theories in his mind.”Unknown (the former leader of REvil) ‘returned from the dead’ and was not happy that his software developers were trying to push his ransomware. The second is that a government agency managed to penetrate the server before they closed shop the first time, got Unknown’s private key and decided to take these new actors down,” Liska said. “Normally, I am pretty dismissive of ‘law enforcement’ conspiracy theories, but given that law enforcement was able to pull the keys from Kaseya attack, it is a real possibility. The relaunch of REvil was ill conceived from the start. Rebranding happens a lot in ransomware after a shutdown. But no one brings old infrastructure that was literally being targeted by every law enforcement operation not named Russia in the world back online. That is just dumb.”Liska said that while some may question whether the drama within the group is real, he believes it is legitimate, noting the internal controversy that has engulfed other ransomware groups this year.”There is a lot of money in ransomware right now, and with lots of money is going to come drama,” he said. But while the REvil operators may have shut down this specific group, Liska said there is no doubt that everyone who was part of the REvil organization will continue to conduct ransomware attacks. “Whether it is through creating a new ransomware or becoming an affiliate for another ransomware group, it is hard to give up the money that can be made from ransomware,” Liska said. Sean Nikkel, Digital Shadows senior cyber threat intel analyst, said REvil was already facing additional scrutiny from the broader cybercriminal community due to drama involving accusations of failing to pay those involved in its partnership program and claims that it effectively cut out affiliates and shared decryption keys with victims.  On XSS, Nikkel said 0_neday was asked about who would work with REvil after this latest series of problems, and the representative replied, “Judging by everything, I’ll be working on my own.””Reaction to the news from other forum members ranged from largely unsympathetic to bordering on conspiracy theory. The main area of debate was whether the group would rebrand for a third time, with many questioning whether the cybercriminal community would still trust REvil-related schemes,” Nikkel explained.  Nikkel added that opinions appeared split on whether REvil’s reputation would ensure the group’s continued success, with many pointing out that all publicity is good publicity, and predicting that the promise of profits would still entice affiliates to work with the group in the future. “One theory doing the rounds posited that a disgruntled former team member, combined with poor password hygiene, could have resulted in the attack,” Nikkel added, noting that many users questioned the fact that this topic was even being discussed on the site at all considering XSS’s May 2021 ban on ransomware-related content. “The XSS representative for the LockBit ransomware group claimed to have predicted this turn of events, providing links to their ‘prophetic’ forum posts. They questioned the REvil representative’s intention to leave the forum, opining ‘if the domains have been hijacked, this is 100% proof that someone had a root on the server, which means that your database has been leaked too.’ The LockBit representative even put forward the idea the new REvil forum account may in fact be operated by law enforcement,” Nikkel said. Nikkel noted that in his opinion, the tone of the REvil’s forum posts indicate the group will be back in some form. But they may face difficulty returning after advertising for affiliates on a 90/10 profit-splitting basis, which is more than the group has shared in previous years. “Despite this, and the many controversies that REvil has been involved in that could have eroded all trust in and willingness to cooperate with the group, it seems that the group’s infamy and the promise of high profits are simply too much of a lure for many cybercriminals, who have returned to work with the group time and time again,” Nikkel said. Senior security researcher for DomainTools Chad Anderson added that his team discovered that REvil had a backdoor in its RaaS offering. After that, multiple affiliates of the REvil program confirmed they had been ripped off by the creators. “It’s hard to say what’s real at this point. We’ve seen groups disappear only to be reborn as a more full featured affiliate program. We’ve seen groups of affiliates shift to better payment models and we’ve seen group sites be taken over by others and their source code leaked or re-used,” Anderson told ZDNet. “At this point evidence suggests that the private keys for the Onion hidden services backing the REvil payment infrastructure have been compromised. This certainly could be a government agency operation but it’s just as likely without hard confirmation that it’s some other ransomware group. REvil made a lot of affiliates mad when it turned out their code had a backdoor that could let REvil operators steal from their affiliates.”Emsisoft ransomware expert Brett Callow was skeptical of what was written in the cybercrime forum, noting that they double as press release services for ransomware gangs.”Threat actors know that law enforcement, researchers and reporters monitor forums, and so use them to issue statements. They say only what they want people to know and believe,” Callow said. “Whether REvil has really closed shop, or are scamming their affiliates, or have some other reason for going dark, is impossible to say.” More

Sinclair Broadcast Group — which controls hundreds of TV stations across the US — has confirmed a ransomware attack on certain servers and workstations.In a statement and notice sent to the SEC, Sinclair said it was notified of a cybersecurity incident on Saturday, October 16. By Sunday, the company confirmed that it was a ransomware attack and backed up what many online had been reporting — outages at numerous local TV stations. “Data also was taken from the Company’s network. The Company is working to determine what information the data contained and will take other actions as appropriate based on its review. Promptly upon detection of the security event, senior management was notified, and the company implemented its incident response plan, took measures to contain the incident, and launched an investigation,” Sinclair said. “Legal counsel, a cybersecurity forensic firm, and other incident response professionals were engaged. The company also notified law enforcement and other governmental agencies. The forensic investigation remains ongoing. While the Company is focused on actively managing this security event, the event has caused – and may continue to cause – disruption to parts of the company’s business, including certain aspects of its provision of local advertisements by its local broadcast stations on behalf of its customers.” The company went on to say that it is unclear what kind of impact the attack will have on its “business, operations or financial results.” It did not say which ransomware group was behind the attack and did not respond to requests for comment. Sinclair controls 21 regional sports network brands while owning and operating 185 television stations in 86 markets. The company also controls the Tennis Channel as well as Stadium and had an annual revenue of $5.9 billion in 2020.The attack was first reported by The Record after viewers took to Twitter and Reddit to report confusion over outages in their local markets. 

Internal sources told The Record that the attack involved the company’s internal corporate network, email servers, phone services, and the broadcasting systems of local TV stations. Dozens of channels were unable to show local morning shows and NFL games on Sunday. Some channels were able to resume broadcasts because the attack did not reach Sinclair’s “master control” broadcast system. But the attack is still crippling dozens of stations even as others return to normal. The company suffered another cyberattack in July that forced them to reset all shared administration systems at all of their stations. This is the second ransomware incident targeting news stations this year, with Cox Media Group recently admitting that it was hit with a ransomware attack in June. Ransomware experts like Darktrace’s Justin Fier said that for broadcasters and media, these attacks don’t only disrupt operations but potentially give bad actors a platform to distribute disinformation on a global stage. “In the case of the Sinclair breach, simply having access to the broadcast network may itself be more valuable for attackers than a ransomware payment,” Fier said. “The reality is that the organization’s back is against the wall — it is clear that the security team at Sinclair have been caught off guard and outpaced and now must decide between system downtime or paying a hefty ransom.”Others noted that it was not surprising to see the attack occur on a weekend when ransomware actors know IT departments are working with skeleton crews. Bill Lawrence, CISO at SecurityGate, noted that the attack didn’t spread to Sinclair’s ‘master control’ broadcast system, indicating they may be using network segmentation or a higher level of protection and care for the ‘crown jewels.’ “Also, they lost their internal network, email, phones, along with local broadcasting systems. For your next incident response plan drill, put the participants in separate rooms and forbid the use of company email or phone calls,” Lawrence said. “It would be hard for them to order a pizza together, much less work on business continuity.” More

Acer has confirmed yet another cyberattack on its servers in Taiwan after their offices in India were hit less than a week ago by the same group.The Desorden Group — which claimed responsibility for both attacks — contacted ZDNet and said part of why they conducted the second attack was to prove their point “that Acer is way behind in its cybersecurity effects on protecting its data and is a global network of vulnerable servers.” Acer spokesman Steven Chung told ZDNet that the company recently detected “an isolated attack on our local after-sales service system in India and a further attack in Taiwan.””Upon detection, we immediately initiated our security protocols and conducted a full scan of our systems. We are notifying all potentially affected customers in India, while the attacked Taiwan system does not involve customer data,” Chung said. “The incident has been reported to local law enforcement and relevant authorities, and has no material impact to our operations and business continuity,” he added.The group said it hacked Acer’s Taiwan servers that stored data on its employees and product information. “We did not steal all data, and only took data pertaining to their employee details. Right after the breach, we informed Acer management on the Taiwan server breach and Acer has since taken the affected server offline,” the group said in an email to ZDNet. 

“Also, a few other of its global networks including Malaysia and Indonesia servers are vulnerable too.”The group did not say how much data they stole in this attack and did not respond to questions about what its end-goal is with these breaches. Acer has had a rough year from a cybersecurity perspective, suffering a ransomware attack in March that led to a previously-unheard ransom demand of $50 million. It is unclear if Acer ever paid the ransom. The attack last week on the company’s servers in India led to 60GB of files being stolen by the Desorden Group, which also claimed an attack on the Malaysian servers of ABX Express Enterprise in September. Acer India was hit with a similar cyberattack in 2012 by a Turkish cybercriminal group, according to DataBreaches.net. The attackers defaced the company website and leaked 20,000 user credentials at the time.  More

A new survey from Gartner found that a majority of CIOs are focusing their investments this year and next year on AI and distributed cloud technology.The 2022 CIO and Technology Executive Survey features data gleaned from 2,387 CIO and technology executive respondents in 85 countries, representing about $9 trillion in revenue/public-sector budgets and $198 billion in IT spending. The survey focused on on “business composability” — which involves the mindset, technologies and set of operating capabilities that enable organizations to innovate and adapt quickly to changing business needs.Monika Sinha, research vice president at Gartner, said business composability is an “antidote to volatility.””Sixty-three percent of CIOs at organizations with high composability* reported superior business performance compared with peers or competitors in the past year. They are better able to pursue new value streams through technology, too,” Sinha said, adding that the findings from the survey were presented during the Gartner IT Symposium/Xpo Americas. Topping the list of planned investments for 2022, cyber and information security was cited by 66% of all respondents as an area that they expected to increase investment for next year. More tha half said business intelligence and data analytics would also be areas where they plan to invest heavily next year. “There is a continued need to invest in cybersecurity as the environment becomes more challenging. A high level of composability would help an enterprise recover faster and potentially even minimize the effects of a cybersecurity incident,” Sinha said.

CIOs and technology executives at high-composability enterprises told Gartner that for 2022, they expect an increase in revenues by about 7.7% and a growth in IT budgets by about 4.2%. Low-composability enterprises only expect both to increase by 3.4% and 3.1%, respectively, according to Gartner. Sinha explained that most high-composability enterprises set up strategic planning and budgeting as a continuous and iterative activity to adjust to change more easily. “Without big deficits to remedy elsewhere, CIOs can afford to invest in composability, especially for IT developers and business architects who can design in a composable manner,” Sinha said, adding that globally, IT budgets are expected to grow at the fastest rate in over ten years with an average growth of 3.6% in overall IT budget for 2022 reported among all survey respondents.The survey also focused on how CIOs can push for composable thinking, composable business architecture and composable technology.”Business composability isn’t uniformly high across the economy because it requires business thinking to be reinvented. Traditional business thinking views change as a risk, while composable thinking is the means to master the risk of accelerating change and to create new business value,” Sinha added.”Digital business initiatives fail when business leaders commission projects from the IT organization and then shirk accountability for the implementation results, treating it as just another IT project. Instead, high-composability enterprises embrace distributed accountability for digital outcomes, reflecting a shift that most CIOs have been trying to make for several years, as well as creates multidisciplinary teams that blend business and IT units to drive business results.”Sinha noted that business runs on technology, but technology itself must be composable to run composable businesses. Composability, Sinha explained, needs to extend throughout the technology stack, from infrastructure that supports rapid integration of new systems and new partners to workplace technology that supports the exchange of ideas.”CIOs at moderate-or low-composability enterprises must internalize these three domains of business composability to make their organization nimbler and well equipped to handle the rapidly changing business environment in which they operate,” Sinha said. “It’s a gradual, but imperative, process going into 2022 and beyond.”  More