Wiki › Adversaries & Campaigns › Cybercrime Groups › REvil (Sodinokibi)

REvil (Sodinokibi)

2 min read

Jump to:

Summary

REvil, also known as Sodinokibi, is a ransomware-as-a-service (RaaS) operation that emerged in 2019. It targets organizations worldwide by encrypting data and demanding ransom payments in cryptocurrency for decryption keys. REvil is known for its sophisticated encryption methods, double extortion tactics involving data theft, and its use of affiliate partnerships to distribute the ransomware. It has been responsible for numerous high-profile attacks affecting various industries, causing significant operational disruption and financial losses.

Key Characteristics

Ransomware-as-a-Service model enabling affiliates to deploy the malware.
Uses strong encryption algorithms to lock victims’ files, making recovery difficult without the decryption key.
Employs double extortion by exfiltrating sensitive data before encryption and threatening public release.
Targets a wide range of sectors including healthcare, finance, manufacturing, and government.
Utilizes multiple infection vectors such as phishing emails, exploit kits, and compromised remote desktop protocols (RDP).
Operates a leak site on the dark web to publish stolen data from victims who refuse to pay.
Demands ransom payments primarily in Bitcoin or Monero cryptocurrencies.

Defensive Controls

Implement robust email filtering and user awareness training to reduce phishing risks.
Apply timely security patches and updates to software and operating systems.
Restrict and monitor remote access protocols, especially RDP, using multi-factor authentication.
Maintain regular, offline backups of critical data to enable recovery without paying ransom.
Deploy endpoint detection and response (EDR) solutions to identify and mitigate ransomware activity.
Use network segmentation to limit lateral movement within the environment.
Monitor network traffic for unusual activity indicative of data exfiltration or ransomware behavior.

Related Security Solutions

Effective mitigation of REvil ransomware involves a combination of security technologies including advanced email security gateways, endpoint protection platforms with behavioral analysis, intrusion detection and prevention systems, and secure backup solutions. Security information and event management (SIEM) systems can assist in detecting indicators of compromise, while threat intelligence feeds provide timely information on emerging REvil tactics and infrastructure. Additionally, implementing zero trust network architectures can reduce the attack surface exploited by ransomware operators.

Tags: Application Attacks backup solutions Cybersecurity data encryption double extortion endpoint protection Phishing ransomware ransomware-as-a-service REvil Sodinokibi threat intelligence