Like normal ransomware, REvil encrypts victims’ files and demands payment to receive the encryption key and recover the data. But Sodin has gone one step further, attempting to steal the files themselves and extort payment from those who have backups by threatening to publish confidential data.

Read full article on The Guardian