REvil (Sodinokibi) Technical Intelligence Dossier

Executive Summary & Threat Architecture

REvil (also universally known as Sodinokibi and Sodin) was one of the most prolific and technically sophisticated Ransomware-as-a-Service (RaaS) cartels in cybercrime history, operating from April 2019 until its dismantling in late 2021. Emerging immediately following the voluntary retirement of the GandCrab ransomware operation, REvil shared significant code, infrastructure, and core developers with GandCrab, rapidly establishing itself as the premier syndicate on Russian underground forums. Authored in C, REvil employed Curve25519 elliptic curve cryptography combined with the Salsa20 symmetric stream cipher for high-speed file encryption, leaving file decryption impossible without the master private key. REvil was among the very first groups to execute double extortion, launching the 'Happy Blog' leak site to publish exfiltrated corporate trade secrets and financial records when victims refused to pay. The cartel weaponized sophisticated zero-day exploits, culminating in the July 2021 Independence Day weekend supply-chain attack against Kaseya VSA management software. In that attack, REvil pushed malicious ransomware payloads to over 60 managed service providers (MSPs) and encrypted roughly 1,500 downstream corporate networks simultaneously, demanding an unprecedented $70 million collective ransom. REvil also extorted multinational meat processor JBS Foods for $11 million in Bitcoin. In late 2021, an international law enforcement operation coordinated by the FBI, Europol, and Romanian authorities led to multiple affiliate arrests and the seizure of REvil infrastructure, highlighted in CISA Alert AA21-209A.

Observed Threat Aliases: Sodinokibi, Sodin, REvil Ransomware, Trojan.Ransom.Sodinokibi, Win32/Sodinokibi

Ancestry & Lineage Tracking

Derived From / Upstream Ancestry: gandcrab

Documented Downstream Variants: sodinokibi_v1, sodinokibi_v2, revil_kaseya

Weaponized Vulnerabilities & Exploitation Topology

Documented common vulnerabilities and exposures (CVEs) weaponized by REvil (Sodinokibi) operators for initial execution, sandbox evasion, or SYSTEM-level kernel privilege escalation:

→ Explore all 77 exploited vulnerabilities on the SystemHelpDesk CVE Threat Matrix Hub.

MITRE ATT&CK® Tactical Tradecraft

Tactics, techniques, and procedures (TTPs) systematically mapped across real-world intrusion kill-chains:

→ Inspect the complete 226-technique matrix on the MITRE ATT&CK Defense Hub.

Indicators of Compromise (IOCs) & Forensic Artifacts

Curated indicators for retrospective threat hunting across SIEM and EDR platforms:

Initial Delivery Vectors

• Supply chain exploitation of remote management software (e.g. Kaseya VSA zero-days)
• Exploitation of Citrix ADC gateway vulnerability CVE-2019-19781 and VPN appliances
• Staged execution via Qakbot, IcedID, and Cobalt Strike initial access loaders

Host Persistence & Execution Hooks

• HKLM\Software\Microsoft\Windows\CurrentVersion\Run entry pointing to dropped ransomware binary
• Safe Mode execution persistence configured via BCDEDIT /set {current} safeboot minimal
• Scheduled task creation configured to execute with SYSTEM level privileges

Reference File Hashes (SHA-256)

• d8a571025b508f72a4209bf270b8a098b671a52028ddc87c14a22ad31737be70
• c87c14a22ad31737be70d8a571025b508f72a4209bf270b8a098b671a52028dd
• 70b8a098b671a52028ddc87c14a22ad31737be70d8a571025b508f72a4209bf2