REvil

REvil, also known as Sodinokibi or Sodin, is a ransomware-as-a-service operation first observed in 2019. It emerged as a major financially motivated ransomware family targeting private companies, government entities, schools, hospitals, and other organizations worldwide, with reporting linking it to more than 1,000 victims during its peak activity period from 2019 to 2021. REvil has been associated with high-profile supply-chain and managed service provider compromise activity, including abuse of Kaseya VSA, and early deployments also exploited Oracle WebLogic vulnerability CVE-2019-2725. The operation has been discussed in connection with Russian-speaking cybercriminal ecosystems and former members have been referenced in later ransomware activity.

Technically, REvil is a highly configurable Windows ransomware family operated through an affiliate model in which core operators maintain the malware and payment infrastructure while affiliates conduct intrusions and deploy the encryptor. It stores encrypted JSON configuration data, decrypts strings at runtime, dynamically resolves imports, and can communicate with controllers over HTTPS when configured to do so. The malware includes logic to avoid infecting systems associated with certain languages and keyboard layouts, particularly across Russia, the CIS, and nearby regions, terminating execution when exclusion conditions are met.

Before encryption, REvil can query and modify the Windows Registry to store encryption parameters, victim key material, and system information. Earlier versions also used the Registry for persistence, though that mechanism was later removed. The malware can attempt privilege escalation, including historical use of CVE-2018-8453 and repeated elevation prompts. It also prepares systems for encryption by terminating selected processes, stopping or deleting services associated with backups, databases, mail, and security tooling, and deleting shadow copies to inhibit recovery.

REvil encrypts files on local and network-accessible storage, appends a generated extension to encrypted files, drops ransom notes, and changes the desktop background. Delivery has been observed through exploitation of public-facing applications, malicious email attachments such as weaponized Word documents, and DLL sideloading using a legitimate Windows Defender component to load a malicious library. REvil payloads have also been delivered through Gootloader campaigns that relied on SEO poisoning and compromised websites. The family is widely recognized as one of the defining ransomware operations of the late 2010s and early 2020s.