--- title: REvil ransomware gang returns after two-month hiatus description: Two months after shutting down, the notorious ransomware gang REvil seems to have resumed its operations. canonical_url: https://www.acronis.com/en/tru/posts/revil-ransomware-gang-returns-after-two-month-hiatus/ locale: en last_updated: 2026-10-27 --- * [Home](https://www.acronis.com/en/tru/) * [Articles](https://www.acronis.com/en/tru/posts/) * [Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/) 17 September 2021 # REvil ransomware gang returns after two-month hiatus Two months after shutting down, the notorious ransomware gang REvil seems to have resumed its operations. Author: **[Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/)** [Video 1](https://www.youtube.com/watch?v=0SAaBKKSKrQ) Two months after shutting down, the notorious ransomware gang REvil seems to have resumed its operations. REvil made a lot of news with their "big game" victims over the years, but their [recent attack on Kaseya VSA](https://www.acronis.com/en-us/blog/posts/revil-ransomware-supply-chain-attack-against-msps/) — in which they asked for a $50 million ransom — is one of the largest to date. Researchers noted that shortly after the attack on Kaseya VSA, much of REvil's infrastructure went dark. Now that new samples of REvil are being detected, it's strongly believed the gang is back in business. While REvil is adept at extracting large amounts of money from victims, Acronis Cyber Protect's Active Protection still [recognizes their ransomware and stops it](https://www.acronis.com/en-us/cyber-protection-center/posts/acronis-protects-customers-server-revil-attack-kaseya/) before you become another statistic. Related articles [The Gentlemen: A closer look at a not-so-gentle ransomware-as-a- service operation](https://www.acronis.com/en/tru/posts/the-gentlemen-a-closer-look-at-a-not-so-gentle-ransomware-as-a-service-operation/) [Acronis AI Copilot: Adoption is high and growing among MSPs](https://www.acronis.com/en/tru/posts/acronis-ai-copilot-adoption-is-high-and-growing-among-msps/) [Acronis Cyberthreats Update, October 2026](https://www.acronis.com/en/tru/posts/acronis-cyberthreats-update-october-2026/) [AI agents at work: What Acronis endpoint data reveals about MSP and SMB usage](https://www.acronis.com/en/tru/posts/ai-agents-at-work-what-acronis-endpoint-data-reveals-about-msp-and-smb-usage/)