REvil

Profile narrative

The threat actor is known by the aliases REvil, Sodinokibi and Pinchy Spider, with publicly available information indicating a possible base in Argentina. Observed activity shows the group targeting entities in both the healthcare and energy sectors, as evidenced by a ransomware incident against Argentina’s PAMI social security organization in August 2023 and an earlier attack on Brazil’s Light S.A. electrical utility in June 2020. In the PAMI case the attack temporarily halted the issuance of new prescriptions while appointments and medication purchases continued, and the organization confirmed that server information remained safeguarded. The Light S.A. intrusion involved the actors demanding a $14 million ransom payable in Monero cryptocurrency, with a threatened increase if payment was not made by a set deadline, and the victim’s website became inaccessible during the incident. These actions demonstrate a pattern of seeking financial gain through extortion while causing operational disruption to the victims.

Technical details from the Light S.A. intrusion reveal that the threat actor employs the Sodinokibi ransomware family, distributing packed malware binaries that leverage both 32‑bit and 64‑bit exploits for the CVE‑2018‑8453 vulnerability. The ransomware incorporates a geographic whitelist to select targets and lacks a universal decryption tool, meaning recovery depends solely on the attacker’s private key. Payment instructions are presented via a web page that includes attacker contact information and a chat support function, reinforcing the reliance on cryptocurrency transactions. No public attribution to a state sponsor or larger criminal consortium has been established in the sources provided, though the actor is consistently linked to the Pinchy Spider moniker. The two highlighted campaigns—the 2023 PAMI ransomware event and the 2020 Light S.A. breach—represent the group’s recurrent use of ransomware to encrypt data, demand payment in privacy‑focused currency, and disrupt critical services across different national contexts.

Incidents

Attributed incidents are available to members.

Sources

Sources available to members: 1 source.