Inactive ransomware operator
← All groupsRevil
aka Sodinokibi · 96 victims indexed · first seen 7 years ago · last activity 3 years ago
At a glance
- Status
- inactive
- Aliases
- Sodinokibi
- First seen
- 7 years ago
- Last activity
- 3 years ago
- Onion sites
- 6 known endpoints
- Primary sector
- Information Technology · 12 hits
About
References
294 linksExternal sources curated by the MISP threat-intel community.
- blog.talosintelligence.com/2019/04/sodinokibi-ransomware-exploits-weblogic.html
- zdnet.com/article/revil-ransomware-group-resurfaces-after-brief-hiatus
- macrumors.com/2021/04/26/revil-delists-stolen-apple-schematics-threat
- theverge.com/2021/7/22/22589643/ransomware-kaseya-vsa-decryptor-revil
- fsb.ru/fsb/press/message/single.htm%21id%3D10439388%40fsbMessage.html
- analyst1.com/file-assets/History-of-REvil.pdf
- angle.ankura.com/post/102hcny/revix-linux-ransomware
- blogs.vmware.com/security/2022/09/esxi-targeting-ransomware-the-threats-that-are-after-your-virtual-machines-part-1.html
- cybersecurity.att.com/blogs/labs-research/revils-new-linux-version
- cybleinc.com/2021/07/03/uncensored-interview-with-revil-sodinokibi-ransomware-operators/
- diicot.ro/mass-media/3341-comunicat-de-presa-2-08-11-2021
- documents.trendmicro.com/assets/rpt/rpt-navigating-new-frontiers-trend-micro-2021-annual-cybersecurity-report.pdf
- github.com/f0wl/REconfig-linux
- home.treasury.gov/news/press-releases/jy0471
- ke-la.com/will-the-revils-story-finally-be-over/
- krebsonsecurity.com/2021/11/revil-ransom-arrest-6m-seizure-and-10m-reward/
- malienist.medium.com/revix-linux-ransomware-d736956150d0
- otx.alienvault.com/pulse/60da2c80aa5400db8f1561d5
- query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE54L7v
- russian.rt.com/russia/article/926347-barnaulec-rozysk-fbr-kibermoshennichestvo
Timeline
24 monthsTop countries
Top sectors
MITRE ATT&CK
16 techniques · 10 tacticsTactics
Techniques
- T1566Phishing
- T1190Exploit Public-Facing Application
- T1133External Remote Services
- T1059Command and Scripting Interpreter
- T1053Scheduled Task/Job
- T1543Create or Modify System Process
- T1055Process Injection
- T1562Impair Defenses
- T1027Obfuscated Files or Information
- T1003OS Credential Dumping
- T1021Remote Services
- T1083File and Directory Discovery
- T1082System Information Discovery
- T1041Exfiltration Over C2 Channel
- T1486Data Encrypted for Impact
- T1490Inhibit System Recovery
Recent victims
Loading…
Onion infrastructure
6 known- http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion
- http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/
- http://blogxxu75w63ujqarv476otld7cyjkq4yoswzt4ijadkjwvg3vrvd5yd.onion
- http://blogxxu75w63ujqarv476otld7cyjkq4yoswzt4ijadkjwvg3vrvd5yd.onion/
- http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion
- http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/
Source
Updated 3 years agoData on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.
