revil
Activity analysis
HackerFeeds has tracked 96 victims claimed by revil since August 2019, most recently in November 2022 — ranking #77 of 332 groups (0.3% of all tracked ransomware victims). No new victims have been posted in the last 180 days; the most recent claim was in November 2022. Its most-targeted sector is Technology (18 victims), followed by Manufacturing (15). The United States accounts for 30 victims (61% of those with a known location); 47 victims did not disclose a location.
Victims per year
- 20197
- 202035
- 202141
- 202213
Top sectors
- Technology18
- Manufacturing15
- Healthcare10
- Business Services7
- Financial Services6
- Agriculture and Food Production6
Computed from victims claimed on the group's leak site as collected by HackerFeeds; claims are not independently verified. Monthly reports · Methodology
Group profile
Sodinokibi ransomware group also known as REvil (Ransomware Evil) operates as a ransomware-as-a-service (RaaS) model. After the group compromised his victims, they would threaten to publish the victim's sensitive data on their darknet blog named 'Happy Blog', unless the ransom is paid. The ransomware malware code used by REvil is pretty similar to the ransomware code used by DarkSide - a different threat actor. REvil group claims to steal information after a successful attack on the supplier of the tech giant Apple and stole confidential schematics of their upcoming products.
MITRE ATT&CK TTPs
Initial Access
T1078Valid Accounts
Compromised RDP credentials purchased from underground markets and initial access brokers used to establish footholds.
T1190Exploit Public-Facing Application
REvil exploited Kaseya VSA (CVE-2021-30116), Pulse Secure VPN vulnerabilities, and Oracle WebLogic to gain initial access at scale.
T1195Supply Chain Compromise
The Kaseya VSA supply chain attack (July 2021) leveraged a trusted IT management software vendor to distribute REvil ransomware to thousands of managed service provider customers simultaneously.
Execution
Defense Evasion
T1027Obfuscated Files or Information
REvil payloads are packed with custom packers and configuration encrypted with RC4 to evade static detection.
T1497Virtualization/Sandbox Evasion
REvil includes sandbox detection logic; checks for language/keyboard settings and terminates on CIS country detections.
T1562.001Disable or Modify Tools
Security software disabled via PowerShell; Windows Defender excluded via registry modifications before payload detonation.
Credential Access
T1003.001OS Credential Dumping: LSASS Memory
Mimikatz used to harvest credentials from LSASS memory for lateral movement and privilege escalation.
Discovery
Lateral Movement
T1021.001Remote Services: Remote Desktop Protocol
RDP used for lateral movement within victim networks using harvested credentials.
Exfiltration
T1567.002Exfiltration Over Web Service: Exfiltration to Cloud Storage
Rclone used to exfiltrate sensitive data to cloud storage ahead of encryption for double extortion via the Happy Blog leak site.
Command and Control
T1071.001Application Layer Protocol: Web Protocols
HTTPS used for C2 communication; Tor .onion addresses used for the victim negotiation portal.
Impact
T1486Data Encrypted for Impact
REvil uses Salsa20 for file encryption with Elliptic Curve Diffie-Hellman (ECDH) for key exchange. Partial file encryption used for speed. Appends random extension. Operates as RaaS with ~40% affiliate revenue share.
T1490Inhibit System Recovery
Shadow copies deleted via vssadmin; Windows recovery environment disabled via bcdedit to prevent recovery.
Recent victims
No victims tracked yet.