Cyber criminals using a ransomware-as-a-service scheme have been spotted complaining that the group they rent the malware from could be using a hidden backdoor to grab ransom payments for themselves.

REvil is one of the most notorious and most common forms of ransomware around and has been responsible for several major incidents. The group behind REvil lease their ransomware out to other crooks in exchange for a cut of the profits these affiliates make by extorting Bitcoin payments in exchange for the ransomware decryption keys that the victims need. 

Recommends

• Best VPN services
• Best security keys
• Best antivirus software
• The fastest VPNs

But it seems that cut isn't enough for those behind REvil: it was recently disclosed that there's a secret backdoor coded into their product, which allows REvil to restore the encrypted files without the involvement of the affiliate.  

SEE: A winning strategy for cybersecurity (ZDNet special report) 

This could allow REvil to takeover negotiations with victims, hijack the so-called "customer support" chats -and steal the ransom payments for themselves. 

Analysis of underground forums by cybersecurity researchers at Flashpoint suggests that the disclosure of the REvil backdoor hasn't gone down well with affiliates. 

One forum user claimed to have had suspicions of REvil's tactics, and said their own plans to extort$7 million from a victim was abruptly ended. They believe that one of the REvil authors took over the negotiations using the backdoor and made off with the money. 

Another user on the Russian-speaking forum complained they were tired of "lousy partner programs" used by ransomware groups "you cannot trust",  but also suggested that the status of REvil as one of the most lucrative ransomware-as-a-service schemes means that wannabe ransomware crooks will still flock to become affiliates. That's particuarly the case now the group is back in action after appearing to go on hiatus earlier in the summer. 

For those scammers who think they've been scammed, there's not a lot they can do (and few would have sympathy for them). One forum user suggested any attempt at dealing with this situation would be as useless as trying to arbitrate "against Stalin". 

Ransomware remains one of the key cybersecurity issues facing the world today. For victims of ransomware attacks, it ultimately doesn't matter who is on the other end of the keyboard demanding payment for the decryption key -many will just opt to pay the ransom, percieving it as the best way to restore the network. 

Recommends

The best cloud storage services

Free and cheap personal and small business cloud storage services are everywhere. But, which one is best for you? Let's look at the top cloud storage options.

But even if victims pay the ransom -which isn't recommended because it encourages more ransomware attacks -restoring the network can still be a slow process and it can be weeks or months before services are fully restored. 

SEE:A cloud company asked security researchers to look over its systems. Here's what they found

Be it REvil or any other ransomware gang, the best way to avoid the disruption of a ransomware attack is to prevent attacks in the first place. 

Some of the key ways organisations can help stop ransomware attacks is to make sure operating systems and software across the network is patched with the latest security updates, so cyber criminals can't easily exploit known vulnerabilities to gain an initial foothold. 

Multi-factor authentication should also be applied to all users to provide a barrier to hands-on attackers being able to use stolen usernames and passwords to move around a compromised network. 

MORE ON CYBERSECURITY

• Ransomware attackers targeted this company. Then defenders discovered something curious
• Ransomware: This amateur attack shows how clueless criminals are trying to get in on the action
• FBI reportedly withheld ransomware key from business for 3 weeks in failed sting
• This major ransomware attack was foiled at the last minute. Here's how they spotted it
• Ransomware: These are the two most common ways hackers get inside your network