Is REvil Ransomware Operation Returning as ‘BlackMatter ‘?. More l ikely, an a ffiliate h as r epurposed REvil’s c rypto-locking m alware. The debut of BlackMatter fol lows REvil apparently shutting down following the July 2 attack it unleashed via Kaseya’s remote management software.  New Haron ransomw are gang emerges, borrows from Avaddon and Thanos