{
	"id": "f8367d21-b373-40a1-afa8-61f21961097e",
	"created_at": "2026-04-06T00:15:15.316676Z",
	"updated_at": "2026-04-10T03:20:35.739019Z",
	"deleted_at": null,
	"sha1_hash": "2076fdeb435cab12e6550fe6d87c7bfbe6a73bb6",
	"title": "REvil ransomware gang launches auction site to sell stolen data",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 379801,
	"plain_text": "REvil ransomware gang launches auction site to sell stolen data\r\nBy Catalin Cimpanu\r\nPublished: 2020-06-02 · Archived: 2026-04-05 20:34:18 UTC\r\nThe operators of the REvil (Sodinokibi) ransomware gang have launched today an eBay-like auction site where\r\nthey plan to sell data stolen from the companies they hack.\r\nThe auction portal is the latest trick in REvil's big bag of extortion tactics, and again confirms their role as trend-setter in the ransomware community.\r\nToday, the REvil gang is known to be one of the most active and aggressive ransomware operations. They never\r\ntarget home consumers, but focus primarily on corporate targets.\r\nThey use exploits in network appliances to breach enterprise networks, where they encrypt the victim's files and\r\nask for astronomical extortion fees (with their average demand being ~$260,000, as estimated earlier this year).\r\nThe REvil gang also operates a \"leak site\" on the dark web, where they publish teasers of stolen files, and then the\r\nwhole stolen data, if victims don't pay their desired extortion fee.\r\nHowever, in a blog post on their leak site today, the group announced the launch of a new \"auction\" feature that\r\nwill allow the group to monetize the stolen files instead of releasing them for free, as they did until now.\r\nThe first auction is made up of files stolen from a Canadian agricultural company, hacked and encrypted last\r\nmonth, but which chose not to pay the ransom demand.\r\nhttps://www.zdnet.com/article/revil-ransomware-gang-launches-auction-site-to-sell-stolen-data/\r\nPage 1 of 2\n\nThe company's files are being auctioned from a starting price of $50,000, payable in the Monero cryptocurrency, a\r\ncryptocurrency to which the REvil gang switched from Bitcoin in back in April, citing anonymity and privacy\r\nconcerns.\r\nHowever, while the Canadian company is the first REvil victim to have its files put up for auction, the idea for the\r\nnew auction feature appears to have formed in the minds of the REvil gang during their ongoing extortion of a\r\nNew York law firm that represents celebrities.\r\nWhile trying to ante up the pressure on the NY law firm, in a blog post last week, the REvil gang threatened to\r\nhold an auction for Madonna's private legal documents.\r\nWhile Madonna files have not been put up for an auction just yet, the REvil gang said today that they \"remember\r\nMadonna and other people,\" suggesting that her files will soon be published too, as well as other files stolen from\r\nthe NYC law firm.\r\nrevil-auction-idea.png\r\nImage: ZDNet\r\nEditorial standards\r\nSource: https://www.zdnet.com/article/revil-ransomware-gang-launches-auction-site-to-sell-stolen-data/\r\nhttps://www.zdnet.com/article/revil-ransomware-gang-launches-auction-site-to-sell-stolen-data/\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"Malpedia"
	],
	"references": [
		"https://www.zdnet.com/article/revil-ransomware-gang-launches-auction-site-to-sell-stolen-data/"
	],
	"report_names": [
		"revil-ransomware-gang-launches-auction-site-to-sell-stolen-data"
	],
	"threat_actors": [],
	"ts_created_at": 1775434515,
	"ts_updated_at": 1775791235,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/2076fdeb435cab12e6550fe6d87c7bfbe6a73bb6.pdf",
		"text": "https://archive.orkl.eu/2076fdeb435cab12e6550fe6d87c7bfbe6a73bb6.txt",
		"img": "https://archive.orkl.eu/2076fdeb435cab12e6550fe6d87c7bfbe6a73bb6.jpg"
	}
}