After a two-month hiatus, dark web portals and sites tied to the REvil ransomware gang have come back online, triggering fear within some that attacks from the group may soon resume. One of the most known operated sites called ‘Happy Blog’, where ransomware victims would go to negotiate or pay a ransom, is one of the many REvil sites that have come back online. Recently, REvil was responsible for a number of massive ransomware attacks including the Kaseya attack over the July 4th holiday weekend, which eventually resulted in the threat group shutting down their sites and going dark. It was speculated at this point that REvil went dark in an attempt to possibly rebrand themselves to throw off United States’ law enforcement and security firms. Additionally, the ‘payment portal’ for REvil targets has been restored and is back online as well. At this time, it is unknown if REvil is back in the game and attacking new targets; however, there are no new victims posted on their site as of today. CTAPT will be keeping a close eye on the REvil ransomware gang and be providing updates accordingly.