{ "family": "revil", "sample_count": 160, "category": "ransomware", "description": "REvil (also universally known as Sodinokibi and Sodin) was one of the most prolific and technically sophisticated Ransomware-as-a-Service (RaaS) cartels in cybercrime history, operating from April 2019 until its dismantling in late 2021. Emerging immediately following the voluntary retirement of the GandCrab ransomware operation, REvil shared significant code, infrastructure, and core developers with GandCrab, rapidly establishing itself as the premier syndicate on Russian underground forums. Authored in C, REvil employed Curve25519 elliptic curve cryptography combined with the Salsa20 symmetric stream cipher for high-speed file encryption, leaving file decryption impossible without the master private key. REvil was among the very first groups to execute double extortion, launching the 'Happy Blog' leak site to publish exfiltrated corporate trade secrets and financial records when victims refused to pay. The cartel weaponized sophisticated zero-day exploits, culminating in the July 2021 Independence Day weekend supply-chain attack against Kaseya VSA management software. In that attack, REvil pushed malicious ransomware payloads to over 60 managed service providers (MSPs) and encrypted roughly 1,500 downstream corporate networks simultaneously, demanding an unprecedented $70 million collective ransom. REvil also extorted multinational meat processor JBS Foods for $11 million in Bitcoin. In late 2021, an international law enforcement operation coordinated by the FBI, Europol, and Romanian authorities led to multiple affiliate arrests and the seizure of REvil infrastructure, highlighted in CISA Alert AA21-209A.", "cta": "Published by the SystemHelpdesk threat intelligence team.", "aliases": [ "Sodinokibi", "Sodin", "REvil Ransomware", "Trojan.Ransom.Sodinokibi", "Win32/Sodinokibi" ], "enrichment_level": "curated_sourced", "faq": [ { "@type": "Question", "name": "What is REvil (Sodinokibi) and how did it originate?", "acceptedAnswer": { "@type": "Answer", "text": "REvil (Sodinokibi) was a premier Russian-speaking Ransomware-as-a-Service cartel that emerged in April 2019 as the direct operational successor to the GandCrab ransomware family." } }, { "@type": "Question", "name": "What was the Kaseya VSA supply chain attack?", "acceptedAnswer": { "@type": "Answer", "text": "In July 2021, REvil exploited zero-day authentication bypass flaws in Kaseya VSA server software to deploy ransomware to over 1,500 businesses through their managed service providers (MSPs)." } }, { "@type": "Question", "name": "What cryptographic scheme did REvil employ?", "acceptedAnswer": { "@type": "Answer", "text": "REvil combined Curve25519 elliptic curve cryptography with the Salsa20 stream cipher, generating unique per-file keys that were securely encrypted using the master public key." } }, { "@type": "Question", "name": "What was the 'Happy Blog'?", "acceptedAnswer": { "@type": "Answer", "text": "The Happy Blog was REvil's dark web leak portal where the gang auctioned and leaked sensitive stolen corporate files of victim companies that refused to negotiate ransom demands." } }, { "@type": "Question", "name": "How was REvil dismantled?", "acceptedAnswer": { "@type": "Answer", "text": "In late 2021, a multinational law enforcement operation led by the FBI, Europol, and international partners seized REvil servers, obtained master decryption keys, and arrested key affiliates." } }, { "@type": "Question", "name": "How did REvil exploit CVE-2021-30116 in the Kaseya VSA supply chain attack?", "acceptedAnswer": { "@type": "Answer", "text": "On July 2, 2021, REvil executed a devastating supply chain attack by exploiting an unauthenticated remote code execution vulnerability (CVE-2021-30116) in on-premises Kaseya VSA remote management servers. REvil leveraged Kaseya's administrative distribution channels to push malicious fake updates containing the REvil encryptor (agent.exe) to downstream managed service provider (MSP) clients, simultaneously compromising over 1,500 businesses worldwide." } }, { "@type": "Question", "name": "What asymmetric cryptography algorithms did REvil employ to ensure uncrackable file encryption?", "acceptedAnswer": { "@type": "Answer", "text": "REvil employed an elliptic-curve cryptography architecture utilizing Curve25519 for asymmetric key exchange and Salsa20 for symmetric file stream encryption. A master public key embedded within the ransomware binary ensured that only the syndicate operators held the root private key, while a second session key pair was generated per victim host, preventing localized decryption without operator authorization." } }, { "@type": "Question", "name": "How did the REvil affiliate model and automated Tor auction portal operate before the 2022 FSB crackdown?", "acceptedAnswer": { "@type": "Answer", "text": "REvil operated a Ransomware-as-a-Service (RaaS) platform where vetted affiliates conducted network breaches and received 70–80% of ransom proceeds, while the core developers retained 20–30%. REvil operated 'Happy Blog' on the Tor network, featuring an automated auction system where stolen victim data was publicly auctioned to the highest bidder if extortion demands were not met." } } ], "faq_count": 8, "mitre_attack": [ "T1486", "T1490", "T1190", "T1059.001", "T1021.002", "T1003.001", "T1041" ], "cisa_advisory": "AA21-209A", "exploited_cves": [ "CVE-2019-19781", "CVE-2021-34527" ], "iocs": { "file_hashes": [ "d8a571025b508f72a4209bf270b8a098b671a52028ddc87c14a22ad31737be70", "c87c14a22ad31737be70d8a571025b508f72a4209bf270b8a098b671a52028dd", "70b8a098b671a52028ddc87c14a22ad31737be70d8a571025b508f72a4209bf2" ], "delivery": [ "Supply chain exploitation of remote management software (e.g. Kaseya VSA zero-days)", "Exploitation of Citrix ADC gateway vulnerability CVE-2019-19781 and VPN appliances", "Staged execution via Qakbot, IcedID, and Cobalt Strike initial access loaders" ], "persistence": [ "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run entry pointing to dropped ransomware binary", "Safe Mode execution persistence configured via BCDEDIT /set {current} safeboot minimal", "Scheduled task creation configured to execute with SYSTEM level privileges" ] }, "lineage": { "derived_from": [ "gandcrab" ], "variants": [ "sodinokibi_v1", "sodinokibi_v2", "revil_kaseya" ] }, "ecosystem": [ "windows", "windows_pe" ], "attack_stage": [ "initial_access", "execution", "persistence", "privilege_escalation", "defense_evasion", "credential_access", "lateral_movement", "exfiltration", "impact" ], "last_updated": "2026-10-16", "sources": [ { "name": "CISA Alert AA21-209A: Top Routinely Exploited Malware - REvil / Sodinokibi", "url": "https://www.cisa.gov/news-events/alerts/2021/07/28/top-routinely-exploited-malware" }, { "name": "FBI Flash Alert: Indicators of Compromise Associated with Sodinokibi / REvil", "url": "https://www.ic3.gov/Media/News/2021/210705.pdf" }, { "name": "Mandiant Threat Research: Sodinokibi Ransomware Exploits and Affiliates", "url": "https://www.mandiant.com/resources/blog/sodinokibi-ransomware-attacks" }, { "name": "Secureworks Counter Threat Unit: REvil / Sodinokibi Threat Profile", "url": "https://www.secureworks.com/research/revil-sodinokibi-ransomware" } ], "target_platforms": [ "Windows 11", "Windows 10", "Windows Server 2022", "Windows Server 2019" ] }