Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
High
REvil/Sodinokibi, also known as Sodin, is a sophisticated ransomware discovered in April 2019. This elusive malware encrypts files and cleverly erases its ransom request message, leaving victims unaware. Once encryption is complete, victims receive a Bitcoin ransom demand.
This ransomware evades traditional security measures, infiltrating systems undetected, appealing to cybercriminals due to its stealthy nature. It’s an example of Ransomware-as-a-Service, with code authors and affiliates working together. This model heightens its danger, enabling large-scale attacks with minimal risk.
REvil is linked to the GandCrab ransomware’s authors, who share connections. Globally, it targets organizations and individuals, concentrating on countries like Mexico, the U.S., Japan, and Germany. Notable attacks include JBS Foods, Kaseya, Travelex, and Acer, causing significant disruptions and financial losses.
REvil employs various attack methods, including RDP assaults, software flaws, and phishing. After infiltration, files and backups are encrypted. Sodinokibi ransomware can encrypt data using curve25519/Salsa20 and keys using curve25519/AES-256-CTR. The user’s private key is encrypted by the malware using two public keys. Additionally, this infection uses asymmetric key scheduling and command and control server obfuscation, which enable the malware to function without a connection to the C2.
In summary, REvil/Sodinokibi is a sophisticated ransomware with elusive behavior. It demands Bitcoin ransoms, exploits weaknesses, and poses a significant threat to organizations globally.
The ransom note placed by REvil (Source: Elliptic)