revil

T1078Valid Accounts

Compromised RDP credentials purchased from underground markets and initial access brokers used to establish footholds.

T1190Exploit Public-Facing Application

REvil exploited Kaseya VSA (CVE-2021-30116), Pulse Secure VPN vulnerabilities, and Oracle WebLogic to gain initial access at scale.

T1195Supply Chain Compromise

The Kaseya VSA supply chain attack (July 2021) leveraged a trusted IT management software vendor to distribute REvil ransomware to thousands of managed service provider customers simultaneously.

T1059.001Command and Scripting Interpreter: PowerShell

PowerShell used to download and execute payloads, disable security tools, and perform post-exploitation tasks.

T1218.007Signed Binary Proxy Execution: Msiexec

Msiexec.exe used to execute malicious MSI packages to bypass application control.

T1027Obfuscated Files or Information

REvil payloads are packed with custom packers and configuration encrypted with RC4 to evade static detection.

T1497Virtualization/Sandbox Evasion

REvil includes sandbox detection logic; checks for language/keyboard settings and terminates on CIS country detections.

T1562.001Disable or Modify Tools

Security software disabled via PowerShell; Windows Defender excluded via registry modifications before payload detonation.

T1003.001OS Credential Dumping: LSASS Memory

Mimikatz used to harvest credentials from LSASS memory for lateral movement and privilege escalation.

T1082System Information Discovery

REvil enumerates system locale, keyboard layout, and domain membership to tailor the attack and avoid CIS-region systems.

T1135Network Share Discovery

Network shares enumerated to maximize encryption coverage across the victim environment.

T1021.001Remote Services: Remote Desktop Protocol

RDP used for lateral movement within victim networks using harvested credentials.

T1567.002Exfiltration Over Web Service: Exfiltration to Cloud Storage

Rclone used to exfiltrate sensitive data to cloud storage ahead of encryption for double extortion via the Happy Blog leak site.

T1071.001Application Layer Protocol: Web Protocols

HTTPS used for C2 communication; Tor .onion addresses used for the victim negotiation portal.

T1486Data Encrypted for Impact

REvil uses Salsa20 for file encryption with Elliptic Curve Diffie-Hellman (ECDH) for key exchange. Partial file encryption used for speed. Appends random extension. Operates as RaaS with ~40% affiliate revenue share.

T1490Inhibit System Recovery

Shadow copies deleted via vssadmin; Windows recovery environment disabled via bcdedit to prevent recovery.