Loading story…
Sodinokibi, also known as REvil and BlueCrab, was distributed through multiple intrusion paths while its operators and affiliates steadily refined payload delivery and defense evasion. Researchers documented infections delivered via malspam, spear-phishing, compromised websites, exposed or stolen RDP access, and exploitation of vulnerabilities including CVE-2019-2725, CVE-2018-13379, and CVE-2019-11510. In South Korea, attackers also abused vulnerable WordPress sites for SEO poisoning, planting fake forum pages that pushed victims to download ZIP archives containing malicious JavaScript, which then fetched additional scripts, launched PowerShell, loaded a .NET injector in memory, and executed the ransomware through a Delphi-based loader.
The operation paired technical sophistication with aggressive monetization. Analysts reported frequent changes to JavaScript obfuscation, command-and-control paths, PowerShell execution methods, process injection techniques, and target process names to reduce antivirus detection, alongside logic to disable security tooling and delete Volume Shadow Copies before encryption. IBM described the group’s use of Curve25519, ECDH, Salsa20, AES, and SHA-3 in its encryption workflow, as well as its double-extortion model of stealing data and threatening publication on The Happy Blog. The ransomware was linked to a broad affiliate ecosystem, represented 22% of IBM X-Force incident response engagements in 2020, and was reported to heavily impact organizations in the United States, United Kingdom, Australia, and Canada.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
Beginning on 2020-12-15, AhnLab observed the JavaScript stage add randomized line ordering for each download and switch identifier naming from random strings to English words such as "apple" to evade detection.
AhnLab reported that the malware removed registry autorun registration and had wscript.exe execute the environment-variable command directly. It also changed the PHP endpoint name used by C2 from /check.php to /search.php.
On the same date, AhnLab observed the .NET injector change how it stored the Delphi loader, moving from reversed Base64 encoding to string substitution markers such as "!@#" and later "$%^".
AhnLab observed a BlueCrab/Sodinokibi variant that stopped dropping the PowerShell script to disk and instead stored the .NET injector in the registry for PowerShell to load from there. The same variant also registered the PowerShell command in an environment variable and a Run key for post-reboot execution.
AhnLab observed the BlueCrab/Sodinokibi campaign change its command-and-control communications from HTTP to HTTPS. This marked an infrastructure change in the malware's delivery chain.
IBM said Sodinokibi accounted for 22% of its X-Force incident response engagements during 2020, reflecting the group's prominence in ransomware activity that year.
IBM reported that in 2020 the ransomware's operators deposited USD 1 million in Bitcoin on a Russian-speaking cybercrime forum as part of a drive to recruit more affiliates.
Trend Micro reported that the Sodinokibi ransomware family was first detected in April 2019 and linked to the retired GandCrab ransomware.
3 references tracked. Mallory keeps watching after this page renders.
securityintelligence.com
Open sourceasec.ahnlab.com
Open sourcetrendmicro.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
REvil/Sodinokibi continued to evolve its ransomware toolkit with updated encryption and execution features aimed at improving impact on victim environments. Analysis of version `2.2` showed the malware restored persistence through the Windows `Run` registry key when configured to do so and added use of the Windows Restart Manager to identify processes and services locking targeted files, then terminate those processes or stop and delete services so encryption can proceed. Researchers also noted the malware can remove a critical-process protection flag before killing a process, potentially destabilizing infected systems, while retaining familiar behaviors such as shadow copy deletion, process termination, ransom note deployment, wallpaper changes, and encrypted configuration parsing. Separate reporting tied REvil to a broader set of delivery and targeting methods across Windows, Linux, and enterprise infrastructure. A PowerShell-based loader was observed disabling AMSI, decrypting an embedded payload, and using in-memory shellcode injection to launch REvil without writing the final executable directly to disk. Earlier technical analysis described phishing-delivered JavaScript loaders, PowerShell staging, UAC bypass, optional exploitation of `CVE-2018-8453`, and process hollowing, while additional reporting and indicators linked the group to Linux ransomware samples and exploitation of Oracle WebLogic Server vulnerabilities for initial access. Together, the references show an operation refining both its post-compromise encryption logic and its initial access and execution tradecraft.
Aug 15, 2026
REvil, also known as Sodinokibi and tracked by some researchers as **GOLD SOUTHFIELD**, evolved into one of the most consequential ransomware-as-a-service operations by combining aggressive affiliate-driven intrusions with increasingly sophisticated extortion. Reporting tied the group to multiple access methods including RDP brute force, spam, watering-hole compromises, malvertising, unpatched VPN and RDP systems, and malware such as **IcedID** and **Qakbot**. Researchers also documented how REvil’s malware and ecosystem were reused or repurposed: Secureworks assessed that **LV ransomware** was a modified REvil 2.03 beta with a replaced configuration, while separate reporting linked REvil’s rise to the vacuum left by **GandCrab** and described its shift toward leak-site pressure, targeted credential fields, affiliate tracking, and removal of geographic execution restrictions in later samples. The operation’s most damaging campaign exploited multiple zero-day vulnerabilities in **Kaseya VSA**, abusing the platform’s auto-update mechanism to push ransomware through managed service providers and impact an estimated **1,500 downstream organizations**. Victims included Swedish retailers and dozens of customers served by affected MSPs, prompting Kaseya to shut down SaaS VSA, advise customers to take internet-exposed on-premises servers offline, and work with the FBI. After law-enforcement disruption and arrests, researchers reported revived REvil Tor infrastructure and newly compiled samples in 2022 that appeared to come from source code rather than recycled binaries, with updated keys, payment domains, victim-specific account targeting, and evidence of active development despite one buggy build that renamed files without encrypting them.
Aug 15, 2026
Ransomware operators behind **REvil/Sodinokibi** and **DoppelPaymer** increasingly ran intrusions like targeted espionage campaigns, combining long dwell times, privilege escalation, lateral movement, data theft, and enterprise-wide encryption. Research from Mandiant, Secureworks, JPCERT/JSAC, and CERT-FR describes attackers gaining entry through exposed **RDP** and **VPN** services, phishing-delivered malware such as **QAKBOT**, **Emotet**, and **Dridex**, brute force, and exploitation of internet-facing systems, then expanding control with tools including **Mimikatz**, **BloodHound**, **PsExec**, **WMI**, **Cobalt Strike**, and **Empire**. In many cases, affiliates or partner crews obtained domain administrator access, tampered with backups and security tools, abused Active Directory group policy and scheduled tasks, and used open SMB shares or administrative utilities to push ransomware across networks. REvil also helped normalize **double extortion** by stealing data before encryption, threatening public leaks, and in some cases publishing victim files or warning that stolen information could be sold or used to pressure public companies through market disclosure. Reporting on Sodinokibi showed the gang first releasing allegedly stolen victim data after nonpayment and later promoting leak-site tactics as a standard coercion method, while Sophos observed exfiltration in roughly half of investigated REvil incidents, often staging data in **Mega.nz**. Separate reporting said REvil’s operators secretly retained a master decryption capability and allegedly hijacked affiliate negotiations, underscoring how ransomware-as-a-service groups maintained centralized control even as affiliates conducted the intrusions.
Aug 15, 2026