Revil
Sodinokibi ransomware group also known as REvil (Ransomware Evil) operates as a ransomware-as-a-service (RaaS) model. After the group compromised his victims, they would threaten to publish the victim's sensitive data on their darknet blog named 'Happy Blog', unless the ransom is paid. The ransomware malware code used by REvil is pretty similar to the ransomware code used by DarkSide - a different threat actor. REvil group claims to steal information after a successful attack on the supplier of the tech giant Apple and stole confidential schematics of their upcoming products.
External information
Victims count: 98
Last discovered victim 2022-11-28
First discovered victims: 2019-08-26
Known Locations
Heatmap
Ransom Notes
Tools Used
| Discovery | RMM Tools | Defense Evasion | Credential Theft | OffSec | Networking | LOLBAS | Exfiltration |
|---|---|---|---|---|---|---|---|
|
AdFind
Bloodhound
|
|
|
|
Cobalt Strike
|
|
BITSAdmin
|
PrivatLab
RClone
Sendspace
|
Vulnerabilities Exploited
No vulnerabilities exploited available.
TTPs Matrix
No TTPs available.
Negotiation Chats
20201014
72 msgs
20201104
63 msgs
20201126
79 msgs
20210320
13 msgs
20210329
43 msgs
20210331
23 msgs
20210401
78 msgs
20210407
15 msgs
20210413
156 msgs
20210603
63 msgs
20210604
10 msgs
20210609
58 msgs
20210613
132 msgs
20210616
31 msgs
20210617
67 msgs
20210622
52 msgs
20210628
39 msgs
20210630
42 msgs
20210708
28 msgs
20210709
1 msgs
YARA Rules
No YARA rules available.
Victims (98)
OptiProERP is a leading global provider of industry-specific ERP solutions for manufacture
revil
📅 Discovery Date: 2022-07-25
N/A
SeaChange International (supplier of video delivery software)
revil
📅 Discovery Date: 2020-04-01
N/A
