Reveton

Reveton is a Windows police-themed ransomware family that locks a victim’s screen and displays fraudulent law-enforcement notices accusing the user of crimes such as child pornography or piracy, then demands payment of a supposed fine to restore access. It is widely regarded as an early ransomware-as-a-service operation, emerging in 2011 and becoming prominent in 2012–2014, enabling lower-skilled affiliates to launch campaigns for a fee. Reveton is also referred to as Urausy in some reporting and is associated with a broader ecosystem of locker-style ransomware that preceded large-scale file-encrypting families.

Reveton primarily targeted Windows systems and commonly spread through drive-by compromise chains involving exploit kits, compromised websites, and malvertising. It was observed delivered via exploit kits including Blackhole, Angler, Cool, and related traffic-redirection infrastructure, and it was also pushed as a secondary payload through existing botnets. Distribution has been linked to campaigns using Citadel as a delivery component, as well as large malvertising operations that redirected victims through exploit infrastructure before installation.

Its core behavior is screen locking and extortion through spoofed police or federal-agency branding tailored to the victim’s geography. Variants impersonated agencies such as the FBI or local police and instructed victims to pay through prepaid voucher systems or similar payment channels. Some variants reportedly activated webcams to increase intimidation, and later versions were observed stealing stored passwords, indicating overlap between locker ransomware and credential-theft functionality. Reporting also notes that Reveton infections were frequently accompanied by additional malware, especially banking trojans or password-stealing components, making the visible lock screen only one part of the compromise.

Reveton is historically significant as one of the earliest mature ransomware affiliate businesses and as a bridge between scareware-style lockers and later industrialized ransomware ecosystems. Prosecutors and researchers have linked its development and operation to Belarusian cybercriminal Maksim Silnikau and associates, and the malware has also been connected to criminal groups involved in exploit kits and malvertising operations. Its campaigns affected consumers broadly, especially in North America and Europe, and demonstrated how exploit kits, traffic brokers, botnets, payment laundering, and affiliate programs could be combined into a scalable ransomware business model.