Skip to main content
Darkfield

Operator dossier

Revil (also tracked as Sodinokibi) is a ransomware operator no longer publishing new disclosures. Darkfield has indexed 96 public victims claimed by this operator between August 26, 2019 and November 28, 2022. REvil, also known as Sodinokibi, was a highly sophisticated ransomware-as-a-service operation that emerged in April 2019 and quickly became one of the most prolific and financially successful cybercriminal organizations, primarily motivated by financial gain. The group is believed to have originated from Russia, operating as a RaaS model where core developers rented their ransomware tools to affiliate criminals, and maintained connections to the now-defunct GandCrab ransomware operation with some researchers suggesting personnel overlap. REvil primarily gained initial access through exploiting vulnerabilities in remote desktop protocol implementations, phishing campaigns, and supply chain attacks, employing double extortion tactics where they exfiltrated sensitive data before encryption and threatened to publish it on their "Happy Blog" leak site if ransoms were not paid, using advanced encryption methods that made file recovery nearly impossible without payment. The group conducted several high-profile attacks including the devastating supply chain attack against Kaseya in July 2021 that affected thousands of downstream customers, attacks on major corporations like JBS Foods, and demanded ransoms reaching up to $70 million, ultimately leading to increased law enforcement attention and pressure from international authorities. Following coordinated law enforcement actions and mounting pressure from the U.S. and Russian governments in late 2021, REvil's infrastructure was taken down and the group ceased operations, with several suspected members reportedly arrested by Russian authorities.

Most-targeted sectors

Most-affected countries

Recent disclosures by Revil

All 96 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for Revil →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Inactive ransomware operator

← All groups

Revil

aka Sodinokibi · 96 victims indexed · first seen 7 years ago · last activity 4 years ago

96
Victims indexed
#78 of 364 tracked operators
3y 3m
Active period
Aug 2019 → Nov 2022
10
Countries hit
top United States · 33

At a glance

Status
inactive
Aliases
Sodinokibi
First seen
7 years ago
Last activity
4 years ago
Onion sites
6 known endpoints
Primary sector
Information Technology · 12 hits

About

REvil, also known as Sodinokibi, was a highly sophisticated ransomware-as-a-service operation that emerged in April 2019 and quickly became one of the most prolific and financially successful cybercriminal organizations, primarily motivated by financial gain. The group is believed to have originated from Russia, operating as a RaaS model where core developers rented their ransomware tools to affiliate criminals, and maintained connections to the now-defunct GandCrab ransomware operation with some researchers suggesting personnel overlap. REvil primarily gained initial access through exploiting vulnerabilities in remote desktop protocol implementations, phishing campaigns, and supply chain attacks, employing double extortion tactics where they exfiltrated sensitive data before encryption and threatened to publish it on their "Happy Blog" leak site if ransoms were not paid, using advanced encryption methods that made file recovery nearly impossible without payment. The group conducted several high-profile attacks including the devastating supply chain attack against Kaseya in July 2021 that affected thousands of downstream customers, attacks on major corporations like JBS Foods, and demanded ransoms reaching up to $70 million, ultimately leading to increased law enforcement attention and pressure from international authorities. Following coordinated law enforcement actions and mounting pressure from the U.S. and Russian governments in late 2021, REvil's infrastructure was taken down and the group ceased operations, with several suspected members reportedly arrested by Russian authorities.

References

294 links

External sources curated by the MISP threat-intel community.

Timeline

24 months
2020-04-01T00:00:00+00:00 · 22020-05-01T00:00:00+00:00 · 62020-06-01T00:00:00+00:00 · 52020-07-01T00:00:00+00:00 · 52020-08-01T00:00:00+00:00 · 42020-09-01T00:00:00+00:00 · 22020-10-01T00:00:00+00:00 · 12020-11-01T00:00:00+00:00 · 12020-12-01T00:00:00+00:00 · 12021-01-01T00:00:00+00:00 · 12021-02-01T00:00:00+00:00 · 22021-03-01T00:00:00+00:00 · 22021-04-01T00:00:00+00:00 · 32021-05-01T00:00:00+00:00 · 22021-06-01T00:00:00+00:00 · 22021-07-01T00:00:00+00:00 · 12021-09-01T00:00:00+00:00 · 242021-10-01T00:00:00+00:00 · 42022-04-01T00:00:00+00:00 · 52022-05-01T00:00:00+00:00 · 22022-07-01T00:00:00+00:00 · 12022-08-01T00:00:00+00:00 · 12022-09-01T00:00:00+00:00 · 12022-11-01T00:00:00+00:00 · 3
2020-04-01T00:00:00+00:002022-11-01T00:00:00+00:00

Top countries

🇺🇸 United States
33
🇦🇺 Australia
4
🇬🇧 United Kingdom
4
🇫🇷 France
2
🇦🇷 Argentina
1
🇨🇱 Chile
1
🇿🇦 South Africa
1
🇯🇵 Japan
1
United States dossier →Australia dossier →United Kingdom dossier →France dossier →

Top sectors

Information Technology
12
Healthcare and Public Health
8
Food and Agriculture
6
Communication
5
Financial
5
Critical Manufacturing
4
Government Facilities
4
Commercial Facilities
3
Information Technology dossier →Healthcare and Public Health dossier →Food and Agriculture dossier →Communication dossier →

MITRE ATT&CK

16 techniques · 10 tactics

Tactics

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessLateral MovementCollectionExfiltrationImpact

Techniques

  • T1566Phishing
  • T1190Exploit Public-Facing Application
  • T1133External Remote Services
  • T1059Command and Scripting Interpreter
  • T1053Scheduled Task/Job
  • T1543Create or Modify System Process
  • T1055Process Injection
  • T1562Impair Defenses
  • T1027Obfuscated Files or Information
  • T1003OS Credential Dumping
  • T1021Remote Services
  • T1083File and Directory Discovery
  • T1082System Information Discovery
  • T1041Exfiltration Over C2 Channel
  • T1486Data Encrypted for Impact
  • T1490Inhibit System Recovery

Recent victims

Loading…

Onion infrastructure

6 known
  • http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion
  • http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/
  • http://blogxxu75w63ujqarv476otld7cyjkq4yoswzt4ijadkjwvg3vrvd5yd.onion
  • http://blogxxu75w63ujqarv476otld7cyjkq4yoswzt4ijadkjwvg3vrvd5yd.onion/
  • http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion
  • http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/

Source

Updated 4 years ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time Revil posts a victim.

Add Revil to your watchlist — Pro pings you within 5 minutes of any new Revil leak-site post, Telegram callout, or affiliate-rebrand inference.