REvil and Sodinokibi Ransomware Receives Free Decryptor
Still struggling with a system scrambled by the REvil, aka Sodinokibi ransomware? Worry no more, as a free, universal decryption tool is now available for free, and is easily accessible online.
Romanian security firm Bitdefender claims to have worked closely with an unnamed "trusted law enforcement partner" to produce the universal decryptor. The tool is made available online, free of charge and even contains detailed tutorials and instructions for its use, so that any victims of the REvil ransomware gang who still haven't recovered their files can do so safely.
The decryption tool appears to be genuinely universal, after a bit of a hiccup earlier this summer. REvil's last big hit was the attack on IT company Kaseya and a while after that took place, people thought that a universal decryption key has been released. A little later it turned out that the decryptor was not universal and it only worked when paired with files scrambled in the Kaseya attack, which put a bit of a damper on things.
REvil is one of the two big bads in the current ransomware landscape. The other spot was occupied by the DarkSide group, but both of those criminal outfits seemed to pack their bags and just disappear in the summer of 2021.
The move was possibly prompted by overzealous DarkSide affiliate hackers biting way more than they could chew, attacking Colonial Pipeline earlier this year and causing a massive liquid fuel outage across the US east coast in the process. A few weeks later, REvil pulled off its attack on Kaseya. Both of those incidents generated a vehement response, with president Joe Biden even calling Russian president Vladimir Putin, urging him to put an end to similar ransomware attacks, suspected to originate from hackers based in Russia.
Whether the crooks got scared or are simply playing dead, in an attempt to come back swinging under a different name is anyone's guess. Even though REvil appears to be back, with an alleged member of the criminal outfit answering questions about the gang's disappearance and temporary server shutdown, a lot of security researchers are not buying into the act and believe those are not the main people behind the outfits.
