Threat intelligence / Malware

REvil

[REvil](https://attack.mitre.org/software/S0496) is a ransomware family that has been linked to the [GOLD SOUTHFIELD](https://attack.mitre.org/groups/G0115) group and operated as ransomware-as-a-service (RaaS) since at least April 2019. [REvil](https://attack.mitre.org/software/S0496), which as been used against organizations in the manufacturing, transportation, and electric sectors, is highly configurable and shares code similarities with the GandCrab RaaS.(Citation: Secureworks REvil September 2019)(Citation: Intel 471 REvil March 2020)(Citation: Group IB Ransomware May 2020)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

Labels

malware

37 recorded

Relationships

uses

from FIN7

Group

uses

from GOLD SOUTHFIELD

Group

uses

to Asymmetric Cryptography

Technique

uses

to Create Process with Token

Technique

uses

to Data Destruction

Technique

uses

to Data Encrypted for Impact

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Disable or Modify Tools

Technique

uses

to Domain Groups

Technique

uses

to Drive-by Compromise

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to Fileless Storage

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Inhibit System Recovery

Technique

uses

to Local Storage Discovery

Technique

uses

to Malicious File

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Modify Registry

Technique

uses

to Mutual Exclusion

Technique

uses

to Native API

Technique

uses

to PowerShell

Technique

uses

to Process Injection

Technique

uses

to Query Registry

Technique

uses

to Safe Mode Boot

Technique

uses

to Service Stop

Technique

uses

to Spearphishing Attachment

Technique

uses

to System Information Discovery

Technique

uses

to System Language Discovery

Technique

uses

to System Service Discovery

Technique

uses

to Token Impersonation/Theft

Technique

uses

to Visual Basic

Technique

uses

to Web Protocols

Technique

uses

to Windows Command Shell

Technique

uses

to Windows Management Instrumentation

Technique

15 external

References

mitre-attack

S0496

open

Sodin

—

Sodinokibi

—

Talos Sodinokibi April 2019

https://blog.talosintelligence.com/2019/04/sodinokibi-ransomware-exploits-weblogic.html

open

Secureworks REvil September 2019

https://www.secureworks.com/research/revil-sodinokibi-ransomware

open

Cylance Sodinokibi July 2019

https://threatvector.cylance.com/en_us/home/threat-spotlight-sodinokibi-ransomware.html

open

Group IB Ransomware May 2020

https://www.group-ib.com/whitepapers/ransomware-uncovered.html

open

G Data Sodinokibi June 2019

https://www.gdatasoftware.com/blog/2019/06/31724-strange-bits-sodinokibi-spam-cinarat-and-fake-g-data

open

Intel 471 REvil March 2020

https://intel471.com/blog/revil-ransomware-as-a-service-an-analysis-of-a-ransomware-affiliate-operation/

open

Kaspersky Sodin July 2019

https://securelist.com/sodin-ransomware/91473/

open

McAfee Sodinokibi October 2019

https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/

open

Picus Sodinokibi January 2020

https://www.picussecurity.com/blog/a-brief-history-and-further-technical-analysis-of-sodinokibi-ransomware

open

McAfee REvil October 2019

https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-crescendo/

open

Secureworks GandCrab and REvil September 2019

https://www.secureworks.com/blog/revil-the-gandcrab-connection

open

Tetra Defense Sodinokibi March 2020

https://web.archive.org/web/20210414101816/https://tetradefense.com/incident-response-services/cause-and-effect-sodinokibi-ransomware-analysis/

open