REvil (Windows)Malware
- REvil
- sodin
- Sodinokibi
REvil Beta MD5: bed6fc04aeb785815744706239a1f243 SHA1: 3d0649b5f76dbbff9f86b926afbd18ae028946bf SHA256: 3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45 * Privilege escalation via CVE-2018-8453 (64-bit only) * Rerun with RunAs to elevate privileges * Implements a requirement that if "exp" is set, privilege escalation must be successful for full execution to occur * Implements…From MISP Galaxy
Last reported 2 months ago, by AhnLab ASEC17 reports
ATT&CK techniques
6 of 83 · each with the sentence it comes from- T1021.001Remote Desktop Protocol
“T1021.001 Remote Services: Remote Desktop Protocol”
- T1053.005Scheduled Task
“The propagation of BlackCat in the victim’s IT infrastructure is achieved by either modifying group policies (which results in a scheduled task being created, on each host, that launches the malicious file) or using PsExec.”
- T1110Brute Force
“This fact is very important from the TTPs perspective: on rare occasions, the initial access is gained through a brute force attack against public-facing RDP-servers or just using valid accounts obtained from a third party.”
- T1003OS Credential Dumping
“T1003.001 OS Credential Dumping: LSASS Memory”
- T1007System Service Discovery
“T1007 System Service Discovery”
- T1018Remote System Discovery
“T1018 Remote System Discovery”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
17 reports, newest first · the exact sentence from each-
July 2026 Dark Web Threat Actor Trend Report“…acktivism Handala Healthcare HuggingFace IAB Indictment Kratos law-enforcement logistics Media Military ModernStealer OpenAI RaaS Retail REvil sandbox-escape SCATTEREDSPIDER Sentencing ShinyHunters Stormous TakeDown Telecommunications Z-Pentest”
-
Decoding NightSpire: Ransomware IOCs Aren't Set in Stone“In 2020, Sodinokibi samples were found to include 156 unique embedded commands to terminate processes and services associated with anti-virus products.”
-
Time to Ransom is Money“…t times from some threat actors, including Play, Akira, and Dharma/Crysis, and longer times from others, including (ironically) Rapid, Sodinokibi, and Phobos.”
-
Dusting for fingerprints: ShadowSyndicate, a new RaaS player?“IcedID was detected in attacks involving the following ransomware groups: Karakurt, RansomEXX, Black Basta, Nokoyawa, Quantum, REvil, Xingteam, and Conti.”
-
The old way: BabLock, new ransomware quietly cruising around Europe, Middle East, and Asia“I/O completion port–based multithread encryption is also implemented in ransomware such as LockBit 3.0 / BlackMatter, DarkSide, REvil, and the latest version of Hive v6.”
-
Using Shodan Images to Hunt Down Ransomware Groups“GandCrab—also known as REvil—has rebranded many times and has had many of its affiliates arrested worldwide:”
-
How Progressive Computing Combated a Large-Scale Cyberattack“The REvil ransomware group launched an attack that spread from the MSPs to between 800 and 1,500 businesses worldwide, leaving them virtually paralyzed.”
-
Ransomware, interrupted: Sodinokibi and the supply chain“Ransomware, interrupted: Sodinokibi and the supply chain”
-
Inside the Hive“In July 2021, international media reported that REvil ransomware operators demanded a record-breaking ransom of $70 millions from meat giant JBS in exchange for providing the decryption key.”
-
It’s alive!“Moreover, in June-July the hacker groups DarkSide and REvil disappeared from the radars after the notorious attacks against Colonial Pipeline and Kaseya, respectively.”
-
Lessons Learned During the Kaseya VSA Supply Chain Attack“The REvil ransomware group carried out a sophisticated supply chain attack against Kaseya’s VSA product.”
-
The Hunt to Find Origins of Kaseya's VSA Mass Ransomware“…t ransomware incident that occurred in July 2021, the industry learned that 50-60 MSPs and their managed customers were encrypted by the REvil ransomware gang through the Kaseya VSA remote monitoring and management software.”
-
Huntress VSA Vaccine“As we’ve learned, REvil performed a sophisticated, timed attack on Kaseya VSA servers to distribute Sodinokibi ransomware out to clients and remove traces of them being there.”
-
Rapid Response: Mass MSP Ransomware Incident“…ated in our webinar today, Huntress Security Researcher Caleb Stewart has successfully reproduced the Kaseya VSA exploits used to deploy REvil/Sodinokibi ransomware and released a POC demonstration video depicting:”
-
REvil Twins: Ransomware-as-a-Service program“REvil Twins: Ransomware-as-a-Service program”
-
BlackCat Ransomware: Tactics, Techniques & Mitigation Strategies“The new RaaS program took into account the hostile experience of their predecessors, namely the DarkSide, BlackMatter, and REvil affiliate programs.”
-
Huntress Service: Ransomware Canaries“From CryptoLocker to Locky to Sodinokibi to Maze, ransomware has been a staple in the hacker-verse for a long time.”
Indicators in its reports
named in the reports above- exploit[.]inin 1 report
Copy this indicator · defanged
Thanks — we review every report.