{
    "type": "bundle",
    "id": "bundle--b292fc1d-b73c-4699-93df-13f31a2c4f6a",
    "spec_version": "2.0",
    "objects": [
        {
            "modified": "2023-03-26T20:06:33.317Z",
            "name": "REvil",
            "description": "[REvil](https://attack.mitre.org/software/S0496) is a ransomware family that has been linked to the [GOLD SOUTHFIELD](https://attack.mitre.org/groups/G0115) group and operated as ransomware-as-a-service (RaaS) since at least April 2019. [REvil](https://attack.mitre.org/software/S0496), which as been used against organizations in the manufacturing, transportation, and electric sectors, is highly configurable and shares code similarities with the GandCrab RaaS.(Citation: Secureworks REvil September 2019)(Citation: Intel 471 REvil March 2020)(Citation: Group IB Ransomware May 2020)",
            "x_mitre_platforms": [
                "Windows"
            ],
            "x_mitre_deprecated": false,
            "x_mitre_domains": [
                "enterprise-attack",
                "ics-attack"
            ],
            "x_mitre_version": "2.1",
            "x_mitre_contributors": [
                "Edward Millington"
            ],
            "x_mitre_aliases": [
                "REvil",
                "Sodin",
                "Sodinokibi"
            ],
            "type": "malware",
            "id": "malware--ac61f1f9-7bb1-465e-9b8a-c2ce8e88baf5",
            "created": "2020-08-04T15:06:14.796Z",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "revoked": false,
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://attack.mitre.org/software/S0496",
                    "external_id": "S0496"
                },
                {
                    "source_name": "Sodin",
                    "description": "(Citation: Intel 471 REvil March 2020)(Citation: Kaspersky Sodin July 2019)"
                },
                {
                    "source_name": "Sodinokibi",
                    "description": "(Citation: Secureworks REvil September 2019)(Citation: Intel 471 REvil March 2020)(Citation: G Data Sodinokibi June 2019)(Citation: Kaspersky Sodin July 2019)(Citation: Cylance Sodinokibi July 2019)(Citation: Secureworks GandCrab and REvil September 2019)(Citation: Talos Sodinokibi April 2019)(Citation: McAfee Sodinokibi October 2019)(Citation: McAfee REvil October 2019)(Citation: Picus Sodinokibi January 2020)(Citation: Secureworks REvil September 2019)(Citation: Tetra Defense Sodinokibi March 2020)"
                },
                {
                    "source_name": "Talos Sodinokibi April 2019",
                    "description": "Cadieux, P, et al (2019, April 30). Sodinokibi ransomware exploits WebLogic Server vulnerability. Retrieved August 4, 2020.",
                    "url": "https://blog.talosintelligence.com/2019/04/sodinokibi-ransomware-exploits-weblogic.html"
                },
                {
                    "source_name": "Secureworks REvil September 2019",
                    "description": "Counter Threat Unit Research Team. (2019, September 24). REvil/Sodinokibi Ransomware. Retrieved August 4, 2020.",
                    "url": "https://www.secureworks.com/research/revil-sodinokibi-ransomware"
                },
                {
                    "source_name": "Cylance Sodinokibi July 2019",
                    "description": "Cylance. (2019, July 3). hreat Spotlight: Sodinokibi Ransomware. Retrieved August 4, 2020.",
                    "url": "https://threatvector.cylance.com/en_us/home/threat-spotlight-sodinokibi-ransomware.html"
                },
                {
                    "source_name": "Group IB Ransomware May 2020",
                    "description": "Group IB. (2020, May). Ransomware Uncovered: Attackers\u2019 Latest Methods. Retrieved August 5, 2020.",
                    "url": "https://www.group-ib.com/whitepapers/ransomware-uncovered.html"
                },
                {
                    "source_name": "G Data Sodinokibi June 2019",
                    "description": "Han, Karsten. (2019, June 4). Strange Bits: Sodinokibi Spam, CinaRAT, and Fake G DATA. Retrieved August 4, 2020.",
                    "url": "https://www.gdatasoftware.com/blog/2019/06/31724-strange-bits-sodinokibi-spam-cinarat-and-fake-g-data"
                },
                {
                    "source_name": "Intel 471 REvil March 2020",
                    "description": "Intel 471 Malware Intelligence team. (2020, March 31). REvil Ransomware-as-a-Service \u2013 An analysis of a ransomware affiliate operation. Retrieved August 4, 2020.",
                    "url": "https://intel471.com/blog/revil-ransomware-as-a-service-an-analysis-of-a-ransomware-affiliate-operation/"
                },
                {
                    "source_name": "Kaspersky Sodin July 2019",
                    "description": "Mamedov, O, et al. (2019, July 3). Sodin ransomware exploits Windows vulnerability and processor architecture. Retrieved August 4, 2020.",
                    "url": "https://securelist.com/sodin-ransomware/91473/"
                },
                {
                    "source_name": "McAfee Sodinokibi October 2019",
                    "description": "McAfee. (2019, October 2). McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service \u2013 What The Code Tells Us. Retrieved August 4, 2020.",
                    "url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/"
                },
                {
                    "source_name": "Picus Sodinokibi January 2020",
                    "description": "Ozarslan, S. (2020, January 15). A Brief History of Sodinokibi. Retrieved August 5, 2020.",
                    "url": "https://www.picussecurity.com/blog/a-brief-history-and-further-technical-analysis-of-sodinokibi-ransomware"
                },
                {
                    "source_name": "McAfee REvil October 2019",
                    "description": "Saavedra-Morales, J, et al. (2019, October 20). McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service \u2013 Crescendo. Retrieved August 5, 2020.",
                    "url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-crescendo/"
                },
                {
                    "source_name": "Secureworks GandCrab and REvil September 2019",
                    "description": "Secureworks . (2019, September 24). REvil: The GandCrab Connection. Retrieved August 4, 2020.",
                    "url": "https://www.secureworks.com/blog/revil-the-gandcrab-connection"
                },
                {
                    "source_name": "Tetra Defense Sodinokibi March 2020",
                    "description": "Tetra Defense. (2020, March). CAUSE AND EFFECT: SODINOKIBI RANSOMWARE ANALYSIS. Retrieved December 14, 2020.",
                    "url": "https://www.tetradefense.com/incident-response-services/cause-and-effect-sodinokibi-ransomware-analysis"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "labels": [
                "malware"
            ],
            "x_mitre_attack_spec_version": "3.1.0",
            "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5"
        }
    ]
}