Domino effect: 5000 attack attempts in 22 countries detected as a result of REvil

hacked device- data breach

On July 2, it became known that the REvil ransomware gang perpetrated a large attack against Managed Service Providers (MSPs) and its clients around the world. This led to thousands of companies becoming potential victims of ransomware. At the moment of writing, Kaspersky researchers have already observed over 5000 infection attempts in Europe, North and South America.

REvil (aka Sodinokibi) is one of the most prolific ransomware-as-a-service (RaaS) operators that first surfaced in 2019, and made numerous headlines in the past few months due to the targets they hit and their record ransomware earnings. In this latest attack, REVil infected a provider of IT Management Software for MSP, affecting multiple companies across the world. The attackers deployed a malicious payload via PowerShell script, which, in turn, was presumably executed through the MSP provider’s software.

This script disabled Microsoft Defender for Endpoint protection features and then decoded a malicious executable, which included a legitimate Microsoft binary, an older version of the Microsoft Defender solution, and a malicious library containing REvil ransomware. Using this combination of components in the loader, the attackers were able to exploit the DLL side-loading technique and attack multiple organizations.

Geography of attempted attacks based on Kaspersky’s telemetry

map.png

Using its Threat Intelligence Service, Kaspersky observed more than 5000 attack attempts in 22 countries, with the most affected being Italy (45.2% registered attack attempts), the USA (25.91%), Colombia (14.83%), Germany (3,21%) and Mexico (2.21%).

“Ransomware gangs and their affiliates continue to up their game after high-profile attacks on the Colonial Pipeline and JBS, and many other organizations in different countries since then. This time, REvil operators have carried out a massive attack on MSPs with thousands of managed businesses around the world, infecting them as well,” comments Vladimir Kuskov, Head of Threat Exploration at Kaspersky. “This case once again demonstrates how important it is to implement proper cybersecurity measurements and solutions at all stages – including suppliers and partners.”

Kaspersky protects against this threat and detects it with the following names:

  • UDS:DangerousObject.Multi.Generic
  • Trojan-Ransom.Win32.Gen.gen
  • Trojan-Ransom.Win32.Sodin.gen
  • Trojan-Ransom.Win32.Convagent.gen
  • PDM:Trojan.Win32.Generic (with Behaviour Detection)

Learn more about the latest REvil attack on Securelist.

To keep organizations protected from modern ransomware attacks, Kaspersky recommends to:

  • Use a reliable endpoint security solution, such as Kaspersky Endpoint Security for Business that is powered by exploit prevention, behaviour detection and a remediation engine that is able to roll back malicious actions. KESB also has self-defence mechanisms which can prevent its removal by cybercriminals;
  • Not expose remote desktop services (such as RDP) to public networks unless absolutely necessary and always use strong passwords for them.
  • Promptly install available patches for commercial VPN solutions providing access for remote employees and acting as gateways in your network.
  • Always keep software updated on all the devices you use to prevent ransomware from exploiting vulnerabilities.
  • Focus your defence strategy on detecting lateral movements and data exfiltration to the Internet. Pay special attention to the outgoing traffic to detect cybercriminals’ connections. Backup data regularly. Make sure you can quickly access it in an emergency when needed. Use the latest Threat Intelligence information to stay aware of actual TTPs used by threat actors.
  • Use solutions like Kaspersky Endpoint Detection and Response and Kaspersky Managed Detection and Response service, which help to identify and stop the attack in its early stages, before attackers reach their final goals.

READ MORE:

Protect the corporate environment and educate employees. Dedicated training courses can help, such as the ones provided in the Kaspersky Automated Security Awareness Platform. A free lesson on how to protect from ransomware attacks is available here.

For more news from Top Business Tech, don’t forget to subscribe to our daily bulletin!

Follow us on LinkedIn and Twitter

Amber Donovan-Stevens

Amber is a Content Editor at Top Business Tech

Birmingham Unveils the UK’s Best Emerging HealthTech Advances

Kosta Mavroulakis • 03rd April 2025

The National HealthTech Series hosted its latest event in Birmingham this month, showcasing innovative startups driving advanced health technology, including AI-assisted diagnostics, wearable devices and revolutionary educational tools for healthcare professionals. Health stakeholders drawn from the NHS, universities, industry and front-line patient care met with new and emerging businesses to define the future trajectory of...

Why DEIB is Imperative to Tech’s Future

Hadas Almog from AppsFlyer • 17th March 2025

We’ve been seeing Diversity, Equity, Inclusion, and Belonging (DEIB) initiatives being cut time and time again throughout the tech industry. DEIB dedicated roles have been eliminated, employee resource groups have lost funding, and initiatives once considered crucial have been deprioritised in favour of “more immediate business needs.” The justification for these cuts is often the...

The need to eradicate platform dependence

Sue Azari • 10th March 2025

The advertising industry is undergoing a seismic shift. Connected TV (CTV), Retail Media Networks (RMNs), and omnichannel strategies are rapidly redefining how brands engage with consumers. As digital privacy regulations evolve and platform dynamics shift, advertisers must recognise a fundamental truth. You cannot build a sustainable business on borrowed ground. The recent uncertainty surrounding TikTok...

The need to clean data for effective insight

David Sheldrake • 05th March 2025

There is more data today than ever before. In fact, the total amount of data created, captured, copied, and consumed globally has now reached an incredible 149 zettabytes. The growth of the big mountain is not expected to slow down, either, with it expected to reach almost 400 zettabytes within the next three years. Whilst...

What can be done to democratize VDI?

Dennis Damen • 05th March 2025

Virtual Desktop Infrastructure (VDI) offers businesses enhanced security, scalability, and compliance, yet it remains a niche technology. One of the biggest barriers to widespread adoption is a severe talent gap. Many IT professionals lack hands-on VDI experience, as their careers begin with physical machines and increasingly shift toward cloud-based services. This shortage has created a...

Tech and Business Outlook: US Confident, European Sentiment Mixed

Viva Technology • 11th February 2025

The VivaTech Confidence Barometer, now in its second edition, reveals strong confidence among tech executives regarding the impact of emerging technologies on business competitiveness, particularly AI, which is expected to have the most significant impact in the near future. Surveying tech leaders from Europe and North America, 81% recognize their companies as competitive internationally, with...