type: malware
spec_version: 2.1
id: malware--ac61f1f9-7bb1-465e-9b8a-c2ce8e88baf5
created: 2020-08-04T15:06:14.796Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0496
external_id: S0496
source_name: Sodin
description: (Citation: Intel 471 REvil March 2020)(Citation: Kaspersky Sodin July 2019)
source_name: Sodinokibi
description: (Citation: Secureworks REvil September 2019)(Citation: Intel 471 REvil March 2020)(Citation: G Data Sodinokibi June 2019)(Citation: Kaspersky Sodin July 2019)(Citation: Cylance Sodinokibi July 2019)(Citation: Secureworks GandCrab and REvil September 2019)(Citation: Talos Sodinokibi April 2019)(Citation: McAfee Sodinokibi October 2019)(Citation: McAfee REvil October 2019)(Citation: Picus Sodinokibi January 2020)(Citation: Secureworks REvil September 2019)(Citation: Tetra Defense Sodinokibi March 2020)
source_name: Talos Sodinokibi April 2019
description: Cadieux, P, et al (2019, April 30). Sodinokibi ransomware exploits WebLogic Server vulnerability. Retrieved August 4, 2020.
url: https://blog.talosintelligence.com/2019/04/sodinokibi-ransomware-exploits-weblogic.html
source_name: Secureworks REvil September 2019
description: Counter Threat Unit Research Team. (2019, September 24). REvil/Sodinokibi Ransomware. Retrieved August 4, 2020.
url: https://www.secureworks.com/research/revil-sodinokibi-ransomware
source_name: Cylance Sodinokibi July 2019
description: Cylance. (2019, July 3). hreat Spotlight: Sodinokibi Ransomware. Retrieved August 4, 2020.
url: https://threatvector.cylance.com/en_us/home/threat-spotlight-sodinokibi-ransomware.html
source_name: Group IB Ransomware May 2020
description: Group IB. (2020, May). Ransomware Uncovered: Attackers’ Latest Methods. Retrieved August 5, 2020.
url: https://www.group-ib.com/whitepapers/ransomware-uncovered.html
source_name: G Data Sodinokibi June 2019
description: Han, Karsten. (2019, June 4). Strange Bits: Sodinokibi Spam, CinaRAT, and Fake G DATA. Retrieved August 4, 2020.
url: https://www.gdatasoftware.com/blog/2019/06/31724-strange-bits-sodinokibi-spam-cinarat-and-fake-g-data
source_name: Intel 471 REvil March 2020
description: Intel 471 Malware Intelligence team. (2020, March 31). REvil Ransomware-as-a-Service – An analysis of a ransomware affiliate operation. Retrieved August 4, 2020.
url: https://intel471.com/blog/revil-ransomware-as-a-service-an-analysis-of-a-ransomware-affiliate-operation/
source_name: Kaspersky Sodin July 2019
description: Mamedov, O, et al. (2019, July 3). Sodin ransomware exploits Windows vulnerability and processor architecture. Retrieved August 4, 2020.
url: https://securelist.com/sodin-ransomware/91473/
source_name: McAfee Sodinokibi October 2019
description: McAfee. (2019, October 2). McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service – What The Code Tells Us. Retrieved August 4, 2020.
url: https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/
source_name: Picus Sodinokibi January 2020
description: Ozarslan, S. (2020, January 15). A Brief History of Sodinokibi. Retrieved August 5, 2020.
url: https://www.picussecurity.com/blog/a-brief-history-and-further-technical-analysis-of-sodinokibi-ransomware
source_name: McAfee REvil October 2019
description: Saavedra-Morales, J, et al. (2019, October 20). McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service – Crescendo. Retrieved August 5, 2020.
url: https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-crescendo/
source_name: Secureworks GandCrab and REvil September 2019
description: Secureworks . (2019, September 24). REvil: The GandCrab Connection. Retrieved August 4, 2020.
url: https://www.secureworks.com/blog/revil-the-gandcrab-connection
source_name: Tetra Defense Sodinokibi March 2020
description: Tetra Defense. (2020, March). CAUSE AND EFFECT: SODINOKIBI RANSOMWARE ANALYSIS. Retrieved November 17, 2024.
url: https://web.archive.org/web/20210414101816/https://tetradefense.com/incident-response-services/cause-and-effect-sodinokibi-ransomware-analysis/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-22T02:14:27.600Z
name: REvil
description: [REvil](https://attack.mitre.org/software/S0496) is a ransomware family that has been linked to the [GOLD SOUTHFIELD](https://attack.mitre.org/groups/G0115) group and operated as ransomware-as-a-service (RaaS) since at least April 2019. [REvil](https://attack.mitre.org/software/S0496), which as been used against organizations in the manufacturing, transportation, and electric sectors, is highly configurable and shares code similarities with the GandCrab RaaS.(Citation: Secureworks REvil September 2019)(Citation: Intel 471 REvil March 2020)(Citation: Group IB Ransomware May 2020)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
ics-attack
x_mitre_version: 2.3
x_mitre_attack_spec_version: 3.3.0
x_mitre_contributors: Edward Millington
x_mitre_aliases: REvil
Sodin
Sodinokibi