News for hackers. Stuff that matters.

A comment on Understanding REvil: The Ransomware Gang Behind the Kaseya Attack. Parent comment

Re:Understanding REvil: The Ransomware Gang Behind the Kasey... by boomboomsubban on Thursday July 08, 2021 @05:58AM (#27770027)
Why link to a tweet of a screenshot of a story about the report?

This is the source. https://www.trustwave.com/en-us/resources/blogs/spiderlabs-b...

And as far as I can tell they just arbitrarily claim that without evidence. The way they say it also makes it sound like a partial list of blocked languages, based on former USSR countries like Syria.

[ Parent | on HN ]
Re:Understanding REvil: The Ransomware Gang Behind the Kasey... by curiousgal on Thursday July 08, 2021 @06:22AM (#27770180)
Syria is not a former USSR country my dude.
[ Parent | on HN ]
Re:Understanding REvil: The Ransomware Gang Behind the Kasey... by boomboomsubban on Thursday July 08, 2021 @08:52AM (#27771282)
I'm aware, that's what the report says.
[ Parent | on HN ]
Re:Understanding REvil: The Ransomware Gang Behind the Kasey... by Pokepokalypse on Thursday July 08, 2021 @12:37PM (#27774397)
They were very much a soviet-bloc ally.
[ Parent | on HN ]
Re:Understanding REvil: The Ransomware Gang Behind the Kasey... by jokoon on Thursday July 08, 2021 @06:39AM (#27770280)
Syria has a lot of ties with Russia.
[ Parent | on HN ]
Re:Understanding REvil: The Ransomware Gang Behind the Kasey... by aaron695 on Thursday July 08, 2021 @08:59AM (#27771352)
You think that they don't attack Russian/Ex countries and "Syria" means that claim they are Ex/Russian related is arbitrary?

They famously released Syrian data for free, a month or so later added the Syrian language to the ransomware -

https://krebsonsecurity.com/2019/07/is-revil-the-new-gandcra...

[ Parent | on HN ]
Re:Understanding REvil: The Ransomware Gang Behind the Kasey... by boomboomsubban on Thursday July 08, 2021 @09:13AM (#27771501)
I'm saying they provide no evidence for the claim. They spend a long time going over what is in the config, which they link to, then just say "and they don't target these languages."

Your links supposed anonymous forum post is better evidence, though it's only evidence on the Syria claim is an unlinked announcement and the actions of a group they guess is related.

[ Parent | on HN ]