This cybercriminal group has created an underground auction site for stolen data
In an effort to further profit from their illegal activities, the operators of the REvil ransomware have launched a new auction site which will be used to sell stolen data from victims to the highest bidder.
REvil, which is also known as Sodinokibi, is a massive ransomware operation known for breaching corporate networks though exposed remote desktop services, spam, exploits and hacked Managed Service Providers (MSPs).
After gaining access to a victim’s network, the ransomware gang spreads laterally though the company while stealing any unencrypted data available on workstations and exposed servers. Once they gain administrative access to a domain controller, REvil deploys its ransomware to encrypt all of the computers on a network.
The operators of the REvil ransomware created a data leak site called the “Happy Blog’ earlier this year which the group uses to publish a victim’s data if a ransom is not paid. The site is used to post samples of stolen data in order to persuade victims to pay the group’s ransom. However, if the ransom is not paid, the stolen data is made available for free via a link so that other cybercriminals can use it for their own operations.
Underground auction site
Last month, REvil began leaking the data of celebrity law firm GSMLaw after a ransom was not paid. The ransomware group claimed that it had incriminating data about US President Donald Trump which it was auctioning off to the highest bidder at a starting price of $1m. The group later claimed that it had sold its data on the US President and that it would auction off data about Madonna in the future.
In order to continue generating revenue from its operations, the operators of REvil have added a section dedicated to conducting online auctions to their Happy Blog site.
The group is currently auctioning off the stolen data of a US food distributor at a starting price of $100,000 but this data can be purchased outright at a “Blitz price” of $200,000. At the same time, the data of a Canadian agricultural company is also being auctioned off at a starting price of $50,000 with the option to purchase it right away for $100,000.
To bid on an auction, bidders must agree to make a deposit of 10 percent of the starting price and if they win, they’ll have to pay the full amount in the Monero cryptocurrency. In its announcement, the REvil group also hinted that other auctions of stolen data are coming soon.
Via BleepingComputer
In an effort to further profit from their illegal activities, the operators of the REvil ransomware have launched a new auction site which will be used to sell stolen data from victims to the highest bidder. REvil, which is also known as Sodinokibi, is a massive ransomware operation known for…
