Analysis by Secureworks Counter Threat Unit (CTU) of REvil ransomware samples uploaded to VirusTotal following the reactivation of GOLD SOUTHFIELD infrastructure in April 2022 — shuttered since October 2021 — confirms that the developer retains access to REvil's original source code and that the ransomware is under active development. Multiple samples with distinct modifications and the absence of an official new version designation indicate an ongoing development cycle rather than a simple redeployment of prior tooling.
March 2022 Sample: Eight Distinct Modifications
The March 2022 sample carries a compile timestamp of 2022-03-11 and incorporates functionality from the October 2021 v2.08 sample despite reporting a version value of 1.00. CTU identified eight notable changes from prior versions:
- Command-line string decryption gate (new
-targument): String decryption now requires a pre-determined four-byte integer passed via a-tcommand-line argument. Without the correct value — used to calculate the RC4 key length and encrypted string offset — the executable terminates immediately, preventing sandbox detonation by defenders who lack the value. The integer XORs against a hardcoded value to derive the RC4 key length, which is then used to decrypt runtime-resolved library and function names. - Updated public keys: Both 32-byte hardcoded public keys were replaced — one used to encrypt the session's runtime-generated private key, the other to encrypt "stats" JSON data containing affiliate tracking information, session keys, victim username, locale, and drive details. CTU assesses GOLD SOUTHFIELD may have lost or exposed the original key pairs.
- New configuration storage location: The encrypted configuration structure moved from offset 0x00 to offset 0x50 in the
.datasection, with the 32-byte decryption key now spanning the full byte range (0x00–0xFF) rather than being limited to alphanumeric characters as in prior versions. - Affiliate tracking format change: The
pidandsubaffiliate tracking values — previously bcrypt-hashed integers — are now formatted as GUIDs. Thepidprocessing function was removed entirely, with its code reference replaced by a duplicatesubreference. - Prohibited region check removed: The October 2021 sample had already removed the geographic prohibition logic but retained a hardcoded
falsevariable. The March 2022 sample removes the variable entirely, with no regional execution restrictions remaining in the codebase. - Targeted credentials in
accselement: The previously emptyaccsconfiguration element — designed to hold username/password pairs separated by%for authenticating to protected network resources before encryption — now contains what appear to be victim-specific administrative account credentials, suggesting manual configuration per target. A typo in one credential entry (using5instead of%) indicates human-formatted values. - Updated Tor infrastructure: Ransom notes reference new Tor domains that became active on April 19, 2022, coinciding with GOLD SOUTHFIELD's infrastructure reactivation — including an updated leak site and a ransom payment portal.
- Safe-mode and registry changes: Safe-mode reboot passwords and RunOnce registry values were updated, along with the registry key path (
SOFTWARE\JnX5ywJ) and all value names used to store encryption session data.
April 2022 Sample: Active Development Confirmed by Bug
A second sample with a compile timestamp of April 26, 2022, detected by researcher @JakubKroustek, is functionally near-identical to the March sample but omits the -t string decryption changes. Crucially, a logic inversion bug in the file rename routine — if (!result) instead of if (result) — caused the ransomware to rename files to a random extension without encrypting them: the file was successfully renamed on the first loop iteration but the loop never broke, and the second iteration failed because the source file was already renamed. This bug — a simple conditional inversion by a developer actively modifying the encryption workflow — itself constitutes strong evidence of ongoing, hands-on source code development rather than a static redeployment.