REvil

REvil, also known by its ransomware name Sodinokibi, emerged as one of the most notorious and prolific cybercriminal operations in recent history. Operating primarily under a Ransomware-as-a-Service (RaaS) model, REvil provided its potent ransomware code and infrastructure to affiliates, who then carried out devastating attacks across the globe. Known for its brazen tactics, high ransom demands, and targeting of large enterprises and critical infrastructure, REvil exemplified the escalating threat of financially motivated cybercrime. The group pioneered and popularized the "double extortion" tactic – encrypting victim data while simultaneously exfiltrating sensitive information and threatening to leak it publicly on their dedicated "Happy Blog" leak site if ransom demands were not met. Although officially dismantled by international law enforcement efforts in late 2021 and early 2022, REvil's impact, techniques, and the RaaS model it championed continue to influence the threat landscape, making an understanding of its operations crucial for security professionals.

Origins & Evolution

REvil is widely believed to have emerged in April 2019, shortly after the high-profile shutdown of another major RaaS operation, GandCrab. Significant code similarities between GandCrab and Sodinokibi, along with the timing of REvil's appearance, strongly suggest that REvil was either a direct successor, a rebrand, or operated by core members of the former GandCrab team. The name "REvil" itself is thought to be a contraction of "Ransomware Evil," potentially inspired by the Resident Evil video game series, while "Sodinokibi" was derived from an internal name within the malware code.

The group is strongly suspected to have originated from Russia or Russian-speaking regions. This assessment is based on several factors: the malware code included checks to avoid encrypting systems using Russian or other Commonwealth of Independent States (CIS) keyboard layouts or language settings; the group predominantly targeted organizations outside the CIS; and ultimately, Russia's Federal Security Service (FSB) claimed responsibility for dismantling the group's core infrastructure and arresting members in January 2022, following intelligence sharing prompted by pressure from the United States.

REvil rapidly evolved from its inception, quickly gaining notoriety for its effectiveness and the scale of its attacks. The RaaS model allowed it to scale operations significantly, attracting numerous skilled affiliates. Over time, REvil operators refined their malware, improved evasion techniques, and increased their ransom demands substantially, often demanding millions of dollars. The group's infrastructure, including the "Happy Blog," became a central part of their extortion strategy. Despite a temporary disappearance in mid-2021 following the Kaseya attack and subsequent international pressure, the group's infrastructure briefly reappeared before being definitively seized and dismantled by law enforcement efforts known as "Operation GoldDust." Internal conflicts also reportedly plagued the group, including accusations of the core developers cheating affiliates out of ransom payments via a backdoor, which may have contributed to its eventual downfall. An intrusion set tracked as "Water Mare" has been linked to the operators behind REvil, with key figures like "UNKN" (or "Unknown") acting as public faces or recruiters on underground forums before disappearing.

Tactics & Techniques

REvil operated a sophisticated RaaS model, leveraging a network of skilled affiliates to execute attacks while the core team maintained the ransomware code, C2 infrastructure, and the payment/leak portal. Their modus operandi involved multiple stages, showcasing a range of advanced TTPs.

Tools Commonly Associated with REvil Operations: Cobalt Strike, Mimikatz, PsExec, AdFind, BloodHound, SharpSploit, Process Hacker, PC Hunter, Rclone, MegaSync, FileZilla, PowerShell Empire, Qakbot (as delivery).

Targets or Victimology

REvil's primary motivation was financial gain, achieved through large ransom payments and, occasionally, the sale of stolen data. While not explicitly linked to state-sponsored espionage, the group's targeting sometimes overlapped with geopolitical interests, particularly concerning critical infrastructure, though profit remained the driving force.

The potential impact of a REvil attack was severe, including:

Targeted Industries: REvil was largely indiscriminate but often focused on organizations perceived as having the capacity and incentive to pay large ransoms. Key sectors included:

Targeted Regions: REvil operated globally but had a significant focus on North America (particularly the United States) and Europe. As noted, they actively avoided targeting organizations within Russia and the CIS. Learn more about cybersecurity in the age of IoT.

Attack Campaigns

REvil was responsible for numerous high-impact ransomware campaigns during its operational period. Some of the most notable include:

Defenses

Defending against threats like REvil requires a multi-layered security strategy focusing on prevention, detection, and response. Given REvil's TTPs, the following defenses are particularly relevant:

REvil / Sodinokibi TTPs (MITRE ATT&CK)

Conclusion

REvil (Sodinokibi) represented a significant escalation in the ransomware threat landscape between 2019 and 2021. Operating as a highly successful RaaS platform, it empowered numerous affiliates to conduct devastating attacks globally, pioneering double extortion tactics and targeting critical infrastructure for massive financial gain. Likely originating from Russia and evolving from the remnants of GandCrab, REvil's campaigns against entities like JBS and Kaseya caused widespread disruption and prompted concerted international law enforcement action, leading to its eventual takedown. While the core REvil operation has been dismantled, its legacy persists through the widespread adoption of the RaaS model and double extortion tactics by other cybercriminal groups. Understanding REvil's origins, TTPs, and impact remains vital for security professionals seeking to defend against the ever-evolving ransomware threat. Learn more about what is the MITRE ATT&CK framework.

Found this article interesting? Keep visit thesecmaster.com, and our social media page on Facebook, LinkedIn, Twitter, Telegram, Tumblr, Medium, and Instagram and subscribe to receive tips like this. 

You may also like these articles:

• Ransomware Payments Drop 35% in 2024 as Law Enforcement Disrupts Cybercrime

• LockBit 3.0 Ransomware

• The Impact of AI on Cybersecurity Jobs- Is AI a Threat for Security Professionals?

• Evil Corp (Indrik Spider) hacktivist group

• Hunters International Ransomware-as-a-Service (RaaS) Group