Loading malware…
REvil, also known as Sodinokibi or Sodin, was a prominent ransomware-as-a-service operation in which core operators maintained the malware and payment infrastructure while affiliates conducted intrusions and deployed the payload in victim environments. It became one of the most consequential enterprise ransomware families of its period and was notably used in the 2021 Kaseya supply-chain incident. REvil encrypted victim files and demanded payment for decryption, while also adopting multi-layered extortion tactics that included data theft, threats of publication, pressure on victims’ customers or partners, and announced support for distributed denial-of-service attacks and voice-based harassment to coerce payment.
On Windows systems, REvil has been observed using PowerShell to download files and delete volume shadow copies, storing encryption parameters and host information in the Registry, decoding encrypted strings at runtime, and masquerading as legitimate executables to hinder detection. Delivery has included malicious email attachments such as Microsoft Office documents with obfuscated VBA macros. In at least one major campaign, attackers abused trusted remote management software in a supply-chain compromise to deploy a REvil variant at scale, and reporting on that incident also identified DLL sideloading or DLL planting as part of the attack chain. REvil samples associated with that campaign were also noted to avoid execution on systems configured with Russian and certain Commonwealth of Independent States language settings, a behavior widely interpreted as geofencing.
REvil also expanded beyond traditional Windows enterprise endpoints. A Linux encryptor targeting VMware ESXi environments was identified, reflecting the broader ransomware trend of attacking virtualization infrastructure to maximize operational impact by encrypting multiple hosted systems at once. The malware and its operators were associated with large-scale corporate targeting and affiliate-driven intrusions across enterprise networks rather than opportunistic consumer infections.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
10 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The security researcher noted that all the Pulse Secure VPN servers included in the list were running a firmware version vulnerable to the CVE-2019-11510 vulnerability. Bank Security believes that the hacker who compiled this list scanned the entire internet IPv4 address space for Pulse Secure VPN servers, used an exploit for the CVE-2019-11510 vulnerability to gain access to systems, dump server details (including usernames and passwords), and then collected all the information in one central repository.
CVE-2021-30116, a zero-day vulnerability affecting the Kaseya VSA servers, was used in the Kaseya supply-chain attack. | REvil (aka Sodinokibi) consistently made headlines this year due to its high-profile attacks, including those launched on meat supplier JBS and IT company Kaseya.
After execution, REvil can perform several steps, including: Attempting to escalate its privilege via CVE-2018-8453, or token impersonation and creating a mutex | We examine three major ransomware families that employ these schemes: REvil (aka Sodinokibi), Clop, and Conti.
Exploiting CVE-2018-13379, CVE-2019-11510, and valid accounts, which leads to the abuse of RDP and PsExec, and then the dropping of tools that disable antimalware, exfiltration tools, and, finally, REvil. | We examine three major ransomware families that employ these schemes: REvil (aka Sodinokibi), Clop, and Conti.
Exploiting CVE-2019-2725, which leads to the remote code execution of Certutil/PowerShell for downloading and executing REvil. | We examine three major ransomware families that employ these schemes: REvil (aka Sodinokibi), Clop, and Conti.
... as well as the BlueGate vulnerabilities affecting the Windows Remote Desktop Gateway (tracked as CVE-2020-0609 and CVE-2020-0610). | REvil (short for Ransomware Evil) is a revolutionary ransomware operation... Kaseya warned customers to immediately shut down their VSA server as REvil ransomware was spreading through its auto-update function.
... as well as the BlueGate vulnerabilities affecting the Windows Remote Desktop Gateway (tracked as CVE-2020-0609 and CVE-2020-0610). | REvil (short for Ransomware Evil) is a revolutionary ransomware operation... Kaseya warned customers to immediately shut down their VSA server as REvil ransomware was spreading through its auto-update function.
REvil’s BGH campaign has been successful in leveraging exploits for unpatched VPN products for initial access. This includes ... Citrix ADC gateway (CVE-2019-19781) ... | REvil (short for Ransomware Evil) is a revolutionary ransomware operation... Kaseya warned customers to immediately shut down their VSA server as REvil ransomware was spreading through its auto-update function.
The 2021 Kaseya VSA compromise by REvil used several zero-day vulnerabilities, including CVE-2021-30116 and CVE-2021-30120, which allowed them to bypass authentication requirements to access VSA servers en route to deploying ransomware in up to 1500 downstream client networks. | In early 2021, Quanta Computer, a Taiwanese technology manufacturer and Apple partner, was compromised by the REvil ransomware group... The 2021 Kaseya VSA compromise by REvil used several zero-day vulnerabilities, including CVE-2021-30116 and CVE-2021-30120, which allowed them to bypass authentication requirements to access VSA servers en route to deploying ransomware in up to 1500 downstream client networks.
Computer giant Acer has been hit by a REvil ransomware attack where the threat actors are demanding the largest known ransom to date, $50,000,000.
20 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Bassterlord, a suspected Russian-speaking threat actor who previously served as an affiliate for the LockBit ransomware gang, but also other rival RaaS operations, such as REvil, Avaddon, and RansomExx.
The U.S. Department of Justice today announced the arrest of Ukrainian man accused of deploying ransomware on behalf of the REvil ransomware gang, a Russian-speaking cybercriminal collective that has extorted hundreds of millions from victim organizations.
L’affiliation de FIN7 au RaaS Sodinokibi courant 2020 a par la suite été confirmée.
L’affiliation de FIN7 au RaaS Sodinokibi courant 2020 a par la suite été confirmée.
Bassterlord partnered with at least four ransomware gangs: REvil, RansomEXX, Avadon and LockBit.
Bassterlord partnered with at least four ransomware gangs: REvil, RansomEXX, Avadon and LockBit.
25 distinct techniques documented for this family, organized by ATT&CK tactic.
The content repeatedly describes threat actors and malware using PowerShell to execute payloads, run commands, download additional malware, perform lateral movement, evade defenses, and execute scripts in memory. | Examples include: 'APT28 downloads and executes PowerShell scripts and performs PowerShell commands'; 'APT3 has used PowerShell on victim systems to download and run payloads after exploitation'; 'TA505 has used PowerShell to download and execute malware and reconnaissance scripts.'
REvil can use the Windows command line to delete volume shadow copies and disable recovery.
There is a second option: To escalate using DelegateExecute... when an attempt is made to execute ComputerDefaults, we get a shell with scaled privileges. | It then makes use of CompMgmtLauncher and explorer.exe. The aim is to create a new instance of explorer.exe, which will launch CompMgmtLauncher. | Once the bas64 is deobfuscated, a dll is obtained, which is responsible for bypassing the UAC seen in the dynamic section in the previous point.
actors used the following command to rename one of their tools to a benign file name: ren "%temp%\upload" audiodg.exe ... APT1 ... used ... AcroRD32.exe ... as a name for malware ... APT28 ... changed extensions on files containing exfiltrated data to make them appear benign ... APT32 has renamed a NetCat binary to kb-10233.exe to masquerade as a Windows update.
REvil has used PowerShell to delete volume shadow copies and download files.
REvil can decode encrypted strings to enable execution of commands and payloads.
By targeting virtual machines, ransomware operators can also encrypt multiple servers at once with a single command. In June, researchers spotted a new REvil ransomware Linux encryptor designed to target VMware ESXi virtual machines, a popular enterprise virtual machine platform.
The content repeatedly describes malware and threat actors collecting OS version, computer name, architecture, CPU, memory, disk, language, and other host details; examples include use of commands such as ver, systeminfo, hostname, uname -m, sw_vers -productVersion, and fsutil.
REvil has the ability to identify specific files and directories that are not to be encrypted.
By targeting virtual machines, ransomware operators can also encrypt multiple servers at once with a single command. In June, researchers spotted a new REvil ransomware Linux encryptor designed to target VMware ESXi virtual machines, a popular enterprise virtual machine platform.
The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications.
The malicious actor utilized ScreenConnect remote desktop support software to connect from a compromised MSP to the target enterprise. ScreenConnect was used to copy a batch script to the endpoints, which contained a PowerShell script to download and inject malicious code from Pastebin. | The PowerShell script that was executed checked the processor architecture before utilizing the .NET WebClient class to download content from Pastebin and the Invoke-Expression (IEX) cmdlet to execute code.
REvil can exfiltrate host and malware information to C2 servers.
Sodinokibi operators may steal data in advance and then resort to extortion tactics that exceed the ability of the malware itself. | Those who refuse to pay up, relying on their ability to recover data, will then receive threats to have that data exposed on an auction site the group calls The Happy Blog.
CISA defines ransomware as “an ever-evolving form of malware designed to encrypt files on a device, rendering any files and the systems that rely on them unusable. Malicious actors then demand ransom in exchange for decryption.” | Once launched, the malware may connect to a command-and-control server to enable the criminals to move laterally across networks and encrypt and/or exfiltrate the organization’s data.
243 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Known ransomware family whose code reportedly shared similarities with the Ransom Cartel encryptor.
REvil/Sodinokibi is mentioned only as comparative background about other ransomware operations that were disrupted.
Ransomware family used in the Kaseya supply-chain-style attack to distribute a malicious payload via vulnerable VSA servers, encrypt downstream victim systems, and demand ransom. The content also describes REvil as a prolific ransomware gang/toolset that targeted MSPs and their customers at scale.
Named as another ransomware operation with an affiliate program, used as a comparison point for Darkside's revenue-sharing model.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.