REvil

{
  "id": "ATTACK:enterprise:S0496",
  "title": "REvil",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0496",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--ac61f1f9-7bb1-465e-9b8a-c2ce8e88baf5",
  "external_id": "S0496",
  "domain": "enterprise",
  "created": "2020-08-04T15:06:14.796Z",
  "modified": "2025-10-22T02:14:27.600Z",
  "version": "2.3",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Sodin"
    },
    {
      "source_name": "Sodinokibi"
    },
    {
      "source_name": "Talos Sodinokibi April 2019",
      "url": "https://blog.talosintelligence.com/2019/04/sodinokibi-ransomware-exploits-weblogic.html"
    },
    {
      "source_name": "Secureworks REvil September 2019",
      "url": "https://www.secureworks.com/research/revil-sodinokibi-ransomware"
    },
    {
      "source_name": "Cylance Sodinokibi July 2019",
      "url": "https://threatvector.cylance.com/en_us/home/threat-spotlight-sodinokibi-ransomware.html"
    },
    {
      "source_name": "Group IB Ransomware May 2020",
      "url": "https://www.group-ib.com/whitepapers/ransomware-uncovered.html"
    },
    {
      "source_name": "G Data Sodinokibi June 2019",
      "url": "https://www.gdatasoftware.com/blog/2019/06/31724-strange-bits-sodinokibi-spam-cinarat-and-fake-g-data"
    },
    {
      "source_name": "Intel 471 REvil March 2020",
      "url": "https://intel471.com/blog/revil-ransomware-as-a-service-an-analysis-of-a-ransomware-affiliate-operation/"
    },
    {
      "source_name": "Kaspersky Sodin July 2019",
      "url": "https://securelist.com/sodin-ransomware/91473/"
    },
    {
      "source_name": "McAfee Sodinokibi October 2019",
      "url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/"
    },
    {
      "source_name": "Picus Sodinokibi January 2020",
      "url": "https://www.picussecurity.com/blog/a-brief-history-and-further-technical-analysis-of-sodinokibi-ransomware"
    },
    {
      "source_name": "McAfee REvil October 2019",
      "url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-crescendo/"
    },
    {
      "source_name": "Secureworks GandCrab and REvil September 2019",
      "url": "https://www.secureworks.com/blog/revil-the-gandcrab-connection"
    },
    {
      "source_name": "Tetra Defense Sodinokibi March 2020",
      "url": "https://web.archive.org/web/20210414101816/https://tetradefense.com/incident-response-services/cause-and-effect-sodinokibi-ransomware-analysis/"
    }
  ]
}