REvil

Profile narrative

REvil, also tracked as Sodinokibi, is a Russia-linked cybercriminal group that has operated as one of the most prolific ransomware-as-a-service operations in recent years. The aliases REvil and Sodinokibi are used interchangeably across public reporting and the group's own leak site communications, and the group's infrastructure has been tied by both researchers and law enforcement to actors believed to operate from Russian territory. The group gained international attention for high-impact extortion attacks against critical infrastructure, manufacturing, healthcare, telecommunications, and consumer-facing brands, and it has publicly demanded ransoms reaching as much as $70 million in single incidents. Beyond encryption, the group has consistently used double-extortion tactics, threatening to publish stolen data on its "Happy Blog" Tor leak site if victims refuse to pay.

The group's victimology spans multiple sectors and geographies. Documented targets include managed service providers and downstream customers (Kaseya VSA supply-chain attack, which affected over 1,000 organizations), meat processing (JBS), telecommunications carriers in Spain, Brazil, and the United Kingdom, healthcare organizations such as Grupo Fleury, nuclear and defense subcontractors like Sol Oriens, consumer brands (Acer, Apple-linked supplier Quanta, French Connection, Fujifilm), marketing firms (Fimmick in Hong Kong), pharmaceutical companies (Pierre Fabre, Mipharm), insurance firms (Pan-American Life), regional governments (Fiji's GovNet, Brazil's Rio Grande do Sul court system), and even household-name brand data held by marketing vendors. Ransom demands reported in public sources range from the tens of thousands of dollars asked of individual MSP customers to $50 million against Acer and Quanta, and $70 million against the Kaseya victims. The group has also experimented with monetization beyond ransom payment, at one point launching a dedicated auction site to sell stolen data from victims such as Agromart, with a blitz price of $100,000 and minimum bids of $50,000.

In terms of tactics, techniques, and procedures, public reporting attributes to REvil/Sodinokibi the use of exploit-driven initial access against internet-facing services, including the Kaseya VSA vulnerability, Microsoft Exchange server exploits against Acer, and brute-force or vulnerability exploitation of VPN and RDP services as observed in Sophos investigations. The group has leveraged loaders such as Qbot to gain remote access before deploying ransomware, used signed executables and registry modifications to disable defenses, and propagated through PowerShell commands during the Kaseya campaign. Encryption payloads are paired with data theft to enable double extortion, and stolen proof-of-breach screenshots are routinely posted to the leak site. In addition to ransomware, REvil-affiliated actors have carried out sustained distributed denial-of-service attacks against UK VoIP providers Voip Unlimited and Voipfone, accompanied by large ransom demands. The group has also been linked to a loose coalition of pro-Russian actors; in June 2023 Killnet publicly announced a "Darknet Parliament" alongside Anonymous Sudan and REvil, claiming coordinated action against European banking infrastructure including the European Investment Bank, though direct technical responsibility for that specific incident rests with Killnet.

Attribution and disruption history are part of the group's public record. In January 2022 Russia's FSB detained 14 individuals and seized assets in an operation tied to REvil, after which the group's infrastructure went offline. The leak site reappeared months later without clearly listing new victims, leaving researchers uncertain whether the original operators had returned or whether others had reactivated the brand. Despite that disruption, REvil's prior campaigns have left a documented trail: the Kaseya attack led to FBI recovery of a universal decryptor that was shared with affected victims, and the JBS incident resulted in an $11 million ransom payment confirmed by the company. Public statements from U.S. officials, including comments attributed to the White House Press Secretary, placed ransomware generally and REvil specifically on the agenda of presidential-level discussions with Russia, reflecting the geopolitical weight the group's operations have carried.

Incidents

Attributed incidents are available to members.

Sources

Sources available to members: 68 sources.