Cybercriminals are slowly realizing that the REvil ransomware operators may have been hijacking ransom negotiations, to cut affiliates out of payments. By using a cryptographic scheme that allowed them to decrypt any systems locked by REvil, the operators left their partners out of the deal and stole the entire ransom. Revil ransomware, also known as Sodinokibi, emerged in the first half of 2019 and built a reputation as a successor of the GandCrab ransomware-as-a-service (RaaS) operation.”]