REvil

MITRE ATT&CK: S0496 View on attack.mitre.org

Aliases: Sodin, Sodinokibi, REvil, Revil

First seen
2019-04-01 00:00:00
Malware type
ransomware
Family
Malware family
Operating systems
windows
Related IoCs
491 (125 malicious)
Last IoC activity
2026-10-18 03:21:19
Profile updated
2026-07-07 12:39:08

Targeted industries: manufacturing transportation-and-logistics energy-and-utilities

Context

REvil is a ransomware family that has been linked to the GOLD SOUTHFIELD group and operated as ransomware-as-a-service (RaaS) since at least April 2019. REvil, which as been used against organizations in the manufacturing, transportation, and electric sectors, is highly configurable and shares code similarities with the GandCrab RaaS.

Recent IoC activity

125 malicious indicators in Maltiverse are attributed to REvil (S0496). The 20 most recently updated:

TypeIndicatorUpdatedSources
hostname gopackapp.com 2026-10-17 2
file sample 8c55958dc4f421350c0b0c5ac16004238f4d0957a7fba86832f7da76788a4804 2026-10-16 1
IP address 199.201.89.145 2026-10-15 3
file sample dc788044ba918463ddea34c1128c9f4da56e0778e582ae9abdeb15fdbcc57e80 2026-10-15 1
file sample ecebf9c009fa09c94117538ab8cd6e50a44fd9947f553d5cfe95a186db0a67fd 2026-10-15 1
file sample f0db74843e2fb68310ec371aef5fda63045db9352b9c85d0a716a164c9b781f6 2026-10-14 1
file sample 602375762d88d24ae659c47d25959e52ed5cea1d227609ec486bd42d551ca009 2026-10-14 1
file sample 271ee0949fc0bea797130590629e9bd565a88293a799837da1eae1a653b9cae6 2026-10-11 1
file sample b83081e0e2676da0476f762d0d3efcccf37db54e1fb9ce3b663d4b9557185744 2026-10-11 1
file sample eTeb5BGH.dll 2026-10-07 1
file sample dbug.exe 2026-10-06 1
file sample 9c8c0006666d8294427a2e917a0085b75ac4f6f6e30b25fd96327280f346a089 2026-10-03 1
file sample 8b5ccd10362353e7fc250188505b369f56904decf97719a6ba9ae9c6256f07ff 2026-10-03 1
file sample 498db1354a8ab657af66e7acb8df73c649e18a29ab32408989a46c39654e6337 2026-09-30 1
file sample 4871bea79e651791fb79ef0bc46f61e728c41d27e7f5b8877d0958a8672f26ea 2026-09-30 1
file sample 9e0e76d6a2586fbe94a407a8bf5b3e336ca2e8645ab26eab814b707fac2c25a5 2026-09-28 1
file sample 909b520c493bd868b94e361035c425a343786cf06b935d3a01621dffd849e0fe 2026-09-26 1
file sample 4265b4461d213a6e99447fc255a5d4de9a18b92756cfb66a247472261ab01154 2026-09-25 1
IP address 69.164.206.96 2026-09-24 6
file sample Latest_Crypto.exe 2026-09-24 1

Detection coverage

  • 7 YARA rules
  • 911 Sigma rules

Malware & tools used

  • Data Encrypted for Impact (attack-pattern)
  • Windows Command Shell (attack-pattern)
  • PowerShell (attack-pattern)
  • Asymmetric Cryptography (attack-pattern)
  • Process Injection (attack-pattern)
  • Match Legitimate Resource Name or Location (attack-pattern)
  • Modify Registry (attack-pattern)
  • Data Destruction (attack-pattern)
  • Query Registry (attack-pattern)
  • Visual Basic (attack-pattern)
  • Exfiltration Over C2 Channel (attack-pattern)
  • Service Stop (attack-pattern)
  • System Information Discovery (attack-pattern)
  • Native API (attack-pattern)
  • Malicious File (attack-pattern)
  • Create Process with Token (attack-pattern)
  • Disable or Modify Tools (attack-pattern)
  • Mutual Exclusion (attack-pattern)
  • File and Directory Discovery (attack-pattern)
  • Encrypted/Encoded File (attack-pattern)
  • Drive-by Compromise (attack-pattern)
  • System Service Discovery (attack-pattern)
  • Windows Management Instrumentation (attack-pattern)
  • Deobfuscate/Decode Files or Information (attack-pattern)
  • Spearphishing Attachment (attack-pattern)

Used by threat actors

Exploited vulnerabilities

  • CVE-2018-8453 (vulnerability)
  • CVE-2019-2725 (vulnerability)

Detection rules

  • TRELLIX_ARC_Sodinokobi (yara-rule)
  • MALPEDIA_Win_Revil_Auto (yara-rule)
  • SIGNATURE_BASE_MAL_RANSOM_Revil_Oct20_1 (yara-rule)
  • SEKOIA_Loader_Win_Revil_Loader (yara-rule)
  • SIGNATURE_BASE_APT_MAL_Revil_Kaseya_Jul21_1 (yara-rule)
  • SIGNATURE_BASE_APT_MAL_Revil_Kaseya_Jul21_2 (yara-rule)
  • ARKBIRD_SOLG_RAN_ELF_Revil_Jun_2021_1 (yara-rule)

Reports & references

  • CrowdStrike — Double Trouble Ransomware Data Leak Extortion Part 1 (report)
  • pwc.co.uk — Cyber Threats 2019 Retrospect (report)
  • proofpoint.com — First Step Initial Access Leads Ransomware (report)
  • Microsoft — Human Operated Ransomware Attacks A Preventable Disaster (report)
  • Microsoft — Ransomware As A Service Understanding The Cybercrime Gig Economy And How To Protect Yourself (report)
  • CrowdStrike — Carbon Spider Embraces Big Game Hunting Part 1 (report)
  • CrowdStrike — The Evolution Of Revil Ransomware And Pinchy Spider (report)
  • secureworks.com — Gold Southfield (report)
  • CrowdStrike — Report2020Crowdstrikeglobalthreatreport (report)
  • threatintel.blog — Opblueraven Part1 (report)
  • pwc.co.uk — Pwc Cyber Threats 2020 A Year In Retrospect (report)
  • CrowdStrike — Double Trouble Ransomware Data Leak Extortion Part 2 (report)
  • secureworks.com — Gold Southfield (report)
  • secureworks.com — Revil Sodinokibi Ransomware (report)
  • secureworks.com — Revil The Gandcrab Connection (report)
  • CrowdStrike — Report2021Gtr (report)
  • Cisco Talos — Sodinokibi Ransomware Exploits Weblogic (report)
  • zdnet.com — Revil Ransomware Group Resurfaces After Brief Hiatus (report)
  • macrumors.com — Revil Delists Stolen Apple Schematics Threat (report)
  • theverge.com — Ransomware Kaseya Vsa Decryptor Revil (report)
  • fsb.ru — Single.Htm%21Id%3D10439388%40Fsbmessage (report)
  • analyst1.com — History Of Revil (report)
  • angle.ankura.com — Revix Linux Ransomware (report)
  • blogs.vmware.com — Esxi Targeting Ransomware The Threats That Are After Your Virtual Machines Part 1 (report)
  • cybersecurity.att.com — Revils New Linux Version (report)

External references