REV files used in phishing campaigns

Hi, there's basically nothing new in this, but I'm curious about why cybercriminals use .REV files to deliver their payloads. I mean, for compressed files, they could use .RAR or 7z. However, the vast majority of events I've received lately contain a .REV file hosted on Google Drive, and it's password-protected, of course, the latter to avoid detection. Could this behavior be due to some special feature of REV files? Or is it simply another randomly chosen file type?

campaigns course cybercriminals cybersecurity drive events file files google google drive nothing password phishing phishing campaigns rar vast