{"id":41445,"date":"2021-06-23T00:02:31","date_gmt":"2021-06-23T00:02:31","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/sure-looks-like-someones-pirating-the-revil-ransomware-tweaking-the-binary-in-a-hex-editor-for-their-own-crimes\/"},"modified":"2021-06-23T00:02:31","modified_gmt":"2021-06-23T00:02:31","slug":"sure-looks-like-someones-pirating-the-revil-ransomware-tweaking-the-binary-in-a-hex-editor-for-their-own-crimes","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/sure-looks-like-someones-pirating-the-revil-ransomware-tweaking-the-binary-in-a-hex-editor-for-their-own-crimes\/","title":{"rendered":"Sure looks like someone’s pirating the REvil ransomware, tweaking the binary in a hex editor for their own crimes"},"content":{"rendered":"

It appears someone is pirating the infamous REvil ransomware by tweaking its files for their own purposes.<\/p>\n

In a report<\/a> today, Secureworks said it has seen a ransomware strain it tracks under the name LV infecting Windows machines with malicious binaries that share a lot of similarities with REvil\u2019s code \u2013 the latter of which is operated by a group the researchers label Gold Southfield.<\/p>\n

The criminals operating the LV variant, who Secureworks tracks under the codename Gold Northfield, have been observed in the wild since October 2020. They deploy a lightly tweaked version of REvil\u2019s binary with references to REvil\u2019s command-and-control and data exfiltration infrastructure removed from key configuration files.<\/p>\n