Ransomware Group
Sodinokibi/REvil
Also known as: REvil, Sodin
Status: inactive • First seen 2019-04 • 5,000+ known victims
REvil was one of the most famous ransomware gangs ever. They attacked a software company called Kaseya and through that single attack, they encrypted thousands of businesses around the world at once.
Overview
Sodinokibi, also known as REvil, was one of the most prolific ransomware-as-a-service operations. The group conducted the largest supply chain ransomware attack through Kaseya VSA, affecting thousands of businesses.
Target Industries
Technology, Legal, Manufacturing, Food & Beverage
How They Attack
- • Supply chain attacks
- • RaaS model
- • Double extortion
- • Affiliate program
Notable Victims
Kaseya (2021), JBS Foods (2021), Acer (2021), Quanta Computer (2021)
Is your business exposed?
How to Protect Against Sodinokibi/REvil
- 1.
Implement supply chain security controls
- 2.
Verify vendor security practices
- 3.
Monitor for legacy REvil indicators
MITRE ATT&CK Techniques
Related Groups
Is your business exposed?
Check if your company data is circulating on the dark web
Free scan • No credit card required