REvil Ransomware: What Can We Learn from Published IoCs in 2022?

REvil has been one of the biggest ransomware threats in 2021, pushing the U.S. Department of State to post a US$10 million reward to anyone who can identify and locate the gang’s leaders.¹ AlienVault made headway in identifying REvil-hosting domains.² We subjected these web properties to IP and DNS searches to identify more connected artifacts.

Our analysis allowed us to build detailed threat research materials revealing that:

• The 99 IoCs resolved to more than a hundred IP addresses, 15% of which were dubbed “dangerous” by various malware engines.
• The IP hosts originated from several countries and belonged to various ISPs, attesting to the widespread nature of the REvil infrastructure.
• The malicious IP hosts were shared by many other domains, which could be weaponized to host the ransomware.

Download the threat research materials now to access the complete list of identified artifacts used to conduct additional enrichment and threat analysis as well as trend identification.

---

• [1] https://krebsonsecurity.com/2021/11/revil-ransom-arrest-6m-seizure-and-10m-reward/
• [2] https://otx.alienvault.com/pulse/5d2f819cdc36b2a7d7d5c7f4/