Reveton

Last reviewed: November 2, 2026

Reveton is a type of ransomware that first emerged in 2012. It is known for its "police ransomware" tactic, where it locks a user's computer screen and displays a message purportedly from law enforcement agencies demanding payment of a fine. Reveton primarily targets Windows operating systems and has been distributed through various infection vectors, including drive-by downloads and malicious email attachments. The ransomware is notable for its social engineering techniques, which aim to scare victims into paying the ransom. As of October 2023, Reveton remains a subject of interest in cybersecurity due to its historical impact and the evolution of ransomware tactics.

Overview

Reveton is a ransomware family that gained notoriety for its use of social engineering tactics to extort money from victims. Unlike traditional ransomware that encrypts files, Reveton locks the user's screen and displays a fake warning message from law enforcement agencies. The message typically accuses the victim of illegal activities and demands a fine to unlock the computer. Reveton primarily targets users of Windows operating systems and has been distributed through various methods, including drive-by downloads and malicious email attachments.

History

Reveton first appeared in 2012 and quickly gained attention due to its unique approach to ransomware. Instead of encrypting files, Reveton locked the user's screen and displayed a fake warning message from law enforcement agencies. This tactic, known as "police ransomware," was designed to scare victims into paying a ransom. Over time, Reveton evolved to include more sophisticated techniques, such as the integration of the Citadel malware platform to enhance its distribution capabilities. The ransomware's popularity peaked in the early 2010s, but it has since declined as newer ransomware families have emerged.

Technical characteristics

Reveton is primarily a screen-locking ransomware that uses social engineering tactics to extort money from victims. Upon infection, Reveton locks the user's screen and displays a warning message purportedly from law enforcement agencies. The message accuses the victim of illegal activities and demands a fine to unlock the computer. Reveton does not encrypt files, which differentiates it from many other types of ransomware. The ransomware is typically distributed through drive-by downloads and malicious email attachments. Reveton has also been associated with the Citadel malware platform, which has been used to enhance its distribution capabilities.

Infection vector

Reveton is primarily distributed through drive-by downloads and malicious email attachments. Drive-by downloads occur when a user visits a compromised website that automatically downloads and installs the ransomware onto their computer. Malicious email attachments are another common method of distribution, where the ransomware is disguised as a legitimate file attachment. Once the user opens the attachment, the ransomware is installed on their computer. Reveton has also been associated with the Citadel malware platform, which has been used to enhance its distribution capabilities.

Notable campaigns

Reveton gained notoriety in the early 2010s for its use of social engineering tactics to extort money from victims. One of the most notable campaigns involved the use of fake warning messages from law enforcement agencies, which accused victims of illegal activities and demanded a fine to unlock their computers. This tactic, known as "police ransomware," was designed to scare victims into paying a ransom. Reveton has been associated with the Citadel malware platform, which has been used to enhance its distribution capabilities. The ransomware's popularity peaked in the early 2010s, but it has since declined as newer ransomware families have emerged.

Detection and mitigation

Detecting and mitigating Reveton infections involves several steps. Users can protect themselves by keeping their operating systems and software up to date, using antivirus software, and avoiding suspicious websites and email attachments. If a computer is infected with Reveton, users can try to remove the ransomware by booting into Safe Mode and using antivirus software to scan and remove the infection. In some cases, users may need to restore their systems from a backup to remove the ransomware completely. As of October 2023, Reveton remains a subject of interest in cybersecurity due to its historical impact and the evolution of ransomware tactics.

Sources

Citadel**Citadel** is a type of malware that emerged as a sophisticated banking Trojan. It is designed to steal sensi
Cybersecurity**Cybersecurity** refers to the practice of protecting systems, networks, and programs from digital attacks. T
Malware**Malware** is a term used to describe malicious software designed to harm, exploit, or otherwise compromise t
2017 Ukraine ransomware attacksThe 2017 Ukraine ransomware attacks were a series of cyberattacks that primarily targeted Ukrainian infrastruc
2019 Baltimore ransomware attackThe 2019 Baltimore ransomware attack was a significant cyber incident that affected the city's computer system
2024 Change Healthcare ransomware attackAs of October 2023, there is no public record of a "2024 Change Healthcare ransomware attack." Therefore, this

Categories: Malware

Last updated: November 2, 2026