Loading story…
Ransomware operators behind REvil/Sodinokibi and DoppelPaymer increasingly ran intrusions like targeted espionage campaigns, combining long dwell times, privilege escalation, lateral movement, data theft, and enterprise-wide encryption. Research from Mandiant, Secureworks, JPCERT/JSAC, and CERT-FR describes attackers gaining entry through exposed RDP and VPN services, phishing-delivered malware such as QAKBOT, Emotet, and Dridex, brute force, and exploitation of internet-facing systems, then expanding control with tools including Mimikatz, BloodHound, PsExec, WMI, Cobalt Strike, and Empire. In many cases, affiliates or partner crews obtained domain administrator access, tampered with backups and security tools, abused Active Directory group policy and scheduled tasks, and used open SMB shares or administrative utilities to push ransomware across networks.
REvil also helped normalize double extortion by stealing data before encryption, threatening public leaks, and in some cases publishing victim files or warning that stolen information could be sold or used to pressure public companies through market disclosure. Reporting on Sodinokibi showed the gang first releasing allegedly stolen victim data after nonpayment and later promoting leak-site tactics as a standard coercion method, while Sophos observed exfiltration in roughly half of investigated REvil incidents, often staging data in Mega.nz. Separate reporting said REvil’s operators secretly retained a master decryption capability and allegedly hijacked affiliate negotiations, underscoring how ransomware-as-a-service groups maintained centralized control even as affiliates conducted the intrusions.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
21 events from the most recent confirmed update back to the earliest known activity.
BleepingComputer reported that REvil developers had allegedly embedded a cryptographic backdoor enabling them to decrypt any victim system and secretly hijack ransom negotiations from affiliates.
In early July 2021, Fabian Wosar explained that REvil samples contained a hardcoded operator/master public key, allowing operators holding the corresponding private key to recover system private keys and decrypt any victim machine.
At Japan Security Analyst Conference 2020, Secureworks presented research arguing that targeted ransomware attacks increasingly resembled intrusions using post-compromise techniques such as privilege escalation, lateral movement, and AD-based deployment.
The 2021 BleepingComputer report says underground discussions alleging that REvil operators scammed affiliates by taking over negotiations had circulated since at least 2020.
FireEye/Mandiant presented research on how ransomware operations had matured in 2020, focusing on REvil’s affiliate model and the QAKBOT-to-DoppelPaymer partnership model.
The Mandiant whitepaper says it responded during 2020 to DoppelPaymer deployments in Europe and globally where initial access originated from QAKBOT infections and was later handed to ransomware operators.
The Mandiant Black Hat presentation states that QAKBOT campaigns in early 2020 used unsophisticated phishing for initial compromise and later enabled ransomware developers to access victim environments.
Sodinokibi/REvil published approximately 337MB of allegedly stolen files said to belong to Artech Information Systems after a ransom was not paid on time, marking the group’s first public data leak.
ANSSI stated that BitPaymer victims were compromised through phishing campaigns in July 2019, adding to other known initial access vectors such as weak RDP and compromised websites.
ANSSI said Morphisec published a YARA rule in July 2019 to detect BitPaymer’s custom packer, and ANSSI confirmed it detected the ransomware’s obfuscation layer.
ANSSI reported that CrowdStrike detected a new BitPaymer variant called DoppelPaymer in July 2019 and assessed it might reflect a split within the BitPaymer development team.
The Mandiant Black Hat materials state that REvil, also known as Sodinokibi, was first seen in May 2019 and operated as a ransomware-as-a-service platform.
The Mandiant whitepaper says the actor behind the REvil platform began advertising for affiliates in mid-2019, formalizing its ransomware-as-a-service model.
The Secureworks presentation says ransomware incidents evolved from mail attachments and drive-by downloads to manually operated attacks against corporate networks beginning around 2018.
ANSSI highlighted a notable BitPaymer incident in which multiple Scottish hospitals were compromised.
ANSSI reported that BitPaymer, also known as FriedEx or IEncrypt, has been used since at least July 2017 in manually operated ransomware attacks against private and public organizations.
The Secureworks JSAC 2020 presentation states that WannaCry caused large-scale incidents in 2017 by exploiting public-facing servers vulnerable to MS17-010.
Bitdefender released a universal REvil decryption tool that worked for victims encrypted up to July 13, 2021; the article says it relied on the same master-key capability built into REvil’s cryptographic design.
As part of its forum announcement, REvil linked to a 10MB sample of allegedly stolen financial and tax data from an unnamed victim and threatened to release more if payment was not made.
A public-facing REvil representative known as Unknown said the group had finished a blog for publishing stolen data from non-paying victims and discussed escalating pressure, including possible notifications to stock exchanges such as NASDAQ.
BleepingComputer reported that REvil operators started telling affiliates to copy victim data before encrypting systems so it could be used for extortion on a new leak site.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
news.sophos.com
Open sourcebleepingcomputer.com
Open sourcebleepingcomputer.com
Open sourcebleepingcomputer.com
Open sourcei.blackhat.com
Open sourcei.blackhat.com
Open sourcejsac.jpcert.or.jp
Open sourcecert.ssi.gouv.fr
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **REvil/Sodinokibi** ransomware operation broadened its playbook by combining network-wide encryption with data theft, public leak threats, and dark-web auctions of stolen files. The gang threatened to publish or sell data taken from victims including **GEDIA Automotive Group** and other unnamed companies, sometimes releasing samples such as an Active Directory **AdRecon** report or promising daily disclosures of employee and financial records. REvil also launched an auction site to monetize stolen data from non-paying victims, with opening bids such as **$50,000** in **Monero**, extending the pressure tactics already used in high-profile corporate extortion cases. Intrusions tied to REvil also showed increasingly targeted post-compromise activity. Symantec observed attackers using **Cobalt Strike**, PowerShell, remote access tools, and account creation to move laterally, disable defenses, and deploy ransomware, while also scanning some victim networks for **point-of-sale software** that could enable payment-card theft or prioritize systems for encryption. Reported victims included a New York airport, a New Jersey synagogue, and organizations in services, food, and healthcare, while Microsoft said human-operated ransomware crews were exploiting exposed **RDP**, vulnerable internet-facing systems, and flaws such as **`CVE-2019-19781`** and **`CVE-2019-11510`** before spending weeks or months inside networks prior to encryption.
Aug 15, 2026
REvil, also known as Sodinokibi and tracked by some researchers as **GOLD SOUTHFIELD**, evolved into one of the most consequential ransomware-as-a-service operations by combining aggressive affiliate-driven intrusions with increasingly sophisticated extortion. Reporting tied the group to multiple access methods including RDP brute force, spam, watering-hole compromises, malvertising, unpatched VPN and RDP systems, and malware such as **IcedID** and **Qakbot**. Researchers also documented how REvil’s malware and ecosystem were reused or repurposed: Secureworks assessed that **LV ransomware** was a modified REvil 2.03 beta with a replaced configuration, while separate reporting linked REvil’s rise to the vacuum left by **GandCrab** and described its shift toward leak-site pressure, targeted credential fields, affiliate tracking, and removal of geographic execution restrictions in later samples. The operation’s most damaging campaign exploited multiple zero-day vulnerabilities in **Kaseya VSA**, abusing the platform’s auto-update mechanism to push ransomware through managed service providers and impact an estimated **1,500 downstream organizations**. Victims included Swedish retailers and dozens of customers served by affected MSPs, prompting Kaseya to shut down SaaS VSA, advise customers to take internet-exposed on-premises servers offline, and work with the FBI. After law-enforcement disruption and arrests, researchers reported revived REvil Tor infrastructure and newly compiled samples in 2022 that appeared to come from source code rather than recycled binaries, with updated keys, payment domains, victim-specific account targeting, and evidence of active development despite one buggy build that renamed files without encrypting them.
Aug 15, 2026
**Sodinokibi**, also known as **REvil** and **BlueCrab**, was distributed through multiple intrusion paths while its operators and affiliates steadily refined payload delivery and defense evasion. Researchers documented infections delivered via malspam, spear-phishing, compromised websites, exposed or stolen **RDP** access, and exploitation of vulnerabilities including `CVE-2019-2725`, `CVE-2018-13379`, and `CVE-2019-11510`. In South Korea, attackers also abused vulnerable WordPress sites for **SEO poisoning**, planting fake forum pages that pushed victims to download ZIP archives containing malicious JavaScript, which then fetched additional scripts, launched PowerShell, loaded a .NET injector in memory, and executed the ransomware through a Delphi-based loader. The operation paired technical sophistication with aggressive monetization. Analysts reported frequent changes to JavaScript obfuscation, command-and-control paths, PowerShell execution methods, process injection techniques, and target process names to reduce antivirus detection, alongside logic to disable security tooling and delete **Volume Shadow Copies** before encryption. IBM described the group’s use of **Curve25519**, **ECDH**, **Salsa20**, **AES**, and **SHA-3** in its encryption workflow, as well as its **double-extortion** model of stealing data and threatening publication on **The Happy Blog**. The ransomware was linked to a broad affiliate ecosystem, represented **22%** of IBM X-Force incident response engagements in 2020, and was reported to heavily impact organizations in the United States, United Kingdom, Australia, and Canada.
Aug 14, 2026