After a several month hiatus, REvil ransomware has reemerged into the threat landscape and has claimed responsibility of compromising Midea Group, a Chinese electrical appliance manufacturing organization. REvil has remained fairly silent since the Kaseya hack in 2021 where the group compromised software vendor Kaseya which allowed the successful breach of several IT management service companies. Several members of the REvil organization were reportedly arrested back in January as a part of an international law enforcement operation. In this latest attack, assets exfiltrated by REvil claim to be several terabytes of information including blueprints and firmware sources, financial information, scans of physical ID’s and digital ID documents, screenshots of internal vSphere environments, SSH keys, and several compressed ZIP archives. REvil has already dumped some of the files to their leak site, pushing for the Midea Group to pay the undisclosed ransom. REvil is known for their double extortion tactics in previous attacks, encrypting systems and files alongside exfiltrating the data offsite to use as leverage in ransom demands. CTIX will continue to monitor the fallout of this incident and provide additional updates as more information is released.