REvil

REvil, also known as Sodinokibi, is a financially motivated ransomware operation and successor to GandCrab. It operated a ransomware-as-a-service program in which core operators supplied ransomware and supporting infrastructure while affiliates compromised organizations and deployed payloads in exchange for a share of ransom payments. REvil used file encryption and double extortion, maintaining a leak site to threaten publication of stolen victim data. Its targets included managed service providers, software vendors, their downstream business customers, and food production companies. Notable attacks included the 2021 compromise of JBS and the July 2, 2021 Kaseya VSA supply-chain campaign. In the latter, an affiliate exploited previously unpatched vulnerabilities, including CVE-2021-30116, to bypass authentication and execute commands on VSA servers, then abused their centralized management capabilities to distribute ransomware to downstream organizations. Kaseya reported fewer than 60 directly affected customers and fewer than 1,500 affected downstream businesses. Data theft was not established in that campaign, despite its use elsewhere in REvil operations. REvil ransomware employed encrypted configurations, extensive string encryption, and API hashing to hinder analysis. Its operations were disrupted by infrastructure shutdowns and law enforcement action during 2021, followed by arrests announced in January 2022.