Loading story…
REvil, also known as Sodinokibi, abruptly lost its public-facing and backend infrastructure, with its Tor leak and payment sites, clear-web presence, and the decoder[.]re domain all going offline at roughly the same time. The disappearance was highly unusual for a group whose infrastructure had been comparatively stable, and it followed REvil’s involvement in several high-profile ransomware incidents, including attacks on Kaseya and JBS Foods.
The outage came amid intense law-enforcement and geopolitical pressure after the Kaseya VSA supply-chain attack, which reportedly impacted about 60 managed service providers and more than 1,500 businesses. Reporting cited several possible explanations, including a government takedown, a legal demand that prompted operators to wipe servers, a voluntary shutdown, technical failure, or a rebranding effort, but no definitive cause was confirmed; researchers also warned that even a successful disruption would not necessarily end the threat, as affiliates could regroup or reappear under a new name.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
By October 2021, users visiting REvil's Happy Blog saw a default Fedora nginx 404 page instead of the gang's normal content, indicating the onion services may have been compromised rather than simply offline. REvil spokesperson 0_neday claimed on XSS that attackers used private Tor service keys belonging to former representative UNKN/Unknown to redirect the hidden service.
Starting overnight and observed by early July 13, REvil's dark web, clear web, and backend infrastructure became inaccessible, including its Tor sites and decoder[.]re domain. Analysts described the simultaneous outage as unusual and said the cause was unconfirmed.
On July 2, REvil exploited a zero-day vulnerability in Kaseya VSA remote management software to attack about 60 managed service providers. The campaign went on to affect more than 1,500 businesses and drew major law-enforcement attention.
During the outage, the XSS Russian-speaking hacking forum banned REvil's public-facing representative, 'Unknown.' Reporting also cited unconfirmed forum rumors that REvil may have erased its servers after learning of a government legal request or subpoena.
Following the Kaseya incident, reporting noted that REvil had recently added Kaseya and many of its managed service provider customers to its list of victims. The group was also linked in the coverage to earlier attacks including JBS Foods.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
darkowl.com
Open sourcethreatpost.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
REvil, also known as Sodinokibi and tracked by some researchers as **GOLD SOUTHFIELD**, evolved into one of the most consequential ransomware-as-a-service operations by combining aggressive affiliate-driven intrusions with increasingly sophisticated extortion. Reporting tied the group to multiple access methods including RDP brute force, spam, watering-hole compromises, malvertising, unpatched VPN and RDP systems, and malware such as **IcedID** and **Qakbot**. Researchers also documented how REvil’s malware and ecosystem were reused or repurposed: Secureworks assessed that **LV ransomware** was a modified REvil 2.03 beta with a replaced configuration, while separate reporting linked REvil’s rise to the vacuum left by **GandCrab** and described its shift toward leak-site pressure, targeted credential fields, affiliate tracking, and removal of geographic execution restrictions in later samples. The operation’s most damaging campaign exploited multiple zero-day vulnerabilities in **Kaseya VSA**, abusing the platform’s auto-update mechanism to push ransomware through managed service providers and impact an estimated **1,500 downstream organizations**. Victims included Swedish retailers and dozens of customers served by affected MSPs, prompting Kaseya to shut down SaaS VSA, advise customers to take internet-exposed on-premises servers offline, and work with the FBI. After law-enforcement disruption and arrests, researchers reported revived REvil Tor infrastructure and newly compiled samples in 2022 that appeared to come from source code rather than recycled binaries, with updated keys, payment domains, victim-specific account targeting, and evidence of active development despite one buggy build that renamed files without encrypting them.
Aug 15, 2026
Kaseya disclosed a security incident in its **on-premises VSA** remote management platform after attackers exploited a zero-day vulnerability and pushed ransomware through managed service providers to downstream customers. The company ordered on-premises customers to immediately shut down VSA servers, precautionarily took its SaaS infrastructure offline, and said early impact appeared limited to fewer than 40 direct customers, while later estimates put the downstream toll at **800 to 1,500 businesses**. Kaseya said **SaaS customers were not found compromised**, identified VSA as the only affected product, and worked with FireEye Mandiant, the **FBI**, **CISA**, and Emsisoft on containment, forensics, detection tools, hardening guidance, and patches before restoring services. Researchers and media reports linked the campaign to the **REvil** ransomware gang, which used infrastructure associated with prior REvil operations and demanded **$70 million in bitcoin** for a universal decryptor. The attack caused international disruption, most visibly forcing Sweden’s **Coop** grocery chain to close about **800 stores** after payment systems failed, while other Swedish organizations also reported outages. Kaseya later said fewer than 60 direct customers were affected and that it obtained a universal decryptor from a third party on July 21, distributing it with Emsisoft’s help; the company publicly stated it **did not pay a ransom** directly or indirectly to obtain the tool.
Aug 15, 2026
REvil exploited a zero-day in on-premises **Kaseya VSA** servers to launch a supply-chain ransomware attack that spread through managed service providers and into downstream customer networks, ultimately affecting about 60 MSPs and roughly 1,500 businesses. Researchers reported the attackers used VSA’s privileged access to push a malicious script, attempted to disable Microsoft Defender, abused `certutil`, and side-loaded a malicious DLL using a legitimate `MsMpEng.exe` binary, enabling rapid encryption across victim environments. The gang demanded **$70 million** for a universal decryptor, while defenders published indicators of compromise and detection guidance tied to behaviors such as DLL sideloading and suspicious PowerShell and Windows event activity. A universal decryptor for the Kaseya-related campaign later emerged, but reporting showed the FBI had secretly obtained the key and withheld it for 19 days while weighing a broader operation against the Russia-linked REvil gang. During that delay, many victims restored from backups or absorbed recovery costs before Kaseya received the key on July 21 and worked with Emsisoft to release a decryptor the next day; Bitdefender later published a broader tool for some earlier REvil victims. The campaign-specific key was subsequently leaked on a hacking forum and verified by researchers, reinforcing that it worked for the Kaseya incident but was not a master key for all REvil infections.
Aug 15, 2026