REvil
Software · ATTACK:ics:S0496
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:ics:S0496",
"title": "REvil",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0496",
"snapshot": "ics-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--ac61f1f9-7bb1-465e-9b8a-c2ce8e88baf5",
"external_id": "S0496",
"domain": "ics",
"created": "2020-08-04T15:06:14.796Z",
"modified": "2025-10-22T02:14:27.600Z",
"version": "2.3",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Sodin"
},
{
"source_name": "Sodinokibi"
},
{
"source_name": "Talos Sodinokibi April 2019",
"url": "https://blog.talosintelligence.com/2019/04/sodinokibi-ransomware-exploits-weblogic.html"
},
{
"source_name": "Secureworks REvil September 2019",
"url": "https://www.secureworks.com/research/revil-sodinokibi-ransomware"
},
{
"source_name": "Cylance Sodinokibi July 2019",
"url": "https://threatvector.cylance.com/en_us/home/threat-spotlight-sodinokibi-ransomware.html"
},
{
"source_name": "Group IB Ransomware May 2020",
"url": "https://www.group-ib.com/whitepapers/ransomware-uncovered.html"
},
{
"source_name": "G Data Sodinokibi June 2019",
"url": "https://www.gdatasoftware.com/blog/2019/06/31724-strange-bits-sodinokibi-spam-cinarat-and-fake-g-data"
},
{
"source_name": "Intel 471 REvil March 2020",
"url": "https://intel471.com/blog/revil-ransomware-as-a-service-an-analysis-of-a-ransomware-affiliate-operation/"
},
{
"source_name": "Kaspersky Sodin July 2019",
"url": "https://securelist.com/sodin-ransomware/91473/"
},
{
"source_name": "McAfee Sodinokibi October 2019",
"url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/"
},
{
"source_name": "Picus Sodinokibi January 2020",
"url": "https://www.picussecurity.com/blog/a-brief-history-and-further-technical-analysis-of-sodinokibi-ransomware"
},
{
"source_name": "McAfee REvil October 2019",
"url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-crescendo/"
},
{
"source_name": "Secureworks GandCrab and REvil September 2019",
"url": "https://www.secureworks.com/blog/revil-the-gandcrab-connection"
},
{
"source_name": "Tetra Defense Sodinokibi March 2020",
"url": "https://web.archive.org/web/20210414101816/https://tetradefense.com/incident-response-services/cause-and-effect-sodinokibi-ransomware-analysis/"
}
]
}Explicit source assertions (11)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:ics:S0496 → uses → ATTACK:ics:T0863
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1fd4cf4e-a26c-4fe5-a7fd-f49b8aea8437
Tom Fakterman August 2019ATTACK:ics:S0496 → uses → ATTACK:ics:T0881
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--309e4558-e591-4d03-9bb9-07d30acf011f
McAfee Labs October 2019ATTACK:ics:S0496 → uses → ATTACK:ics:T0849
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5e099568-fb5c-4f58-af7e-4e1b7a9d1128
Tom Fakterman August 2019ATTACK:ics:G0046 → uses → ATTACK:ics:S0496
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--65adbdda-7069-40ed-9825-b79ec87e4916
CrowdStrike Carbon Spider August 2021 · Microsoft Ransomware as a Service · IBM Ransomware Trends September 2020 · FBI Flash FIN7 USBATTACK:ics:S0496 → uses → ATTACK:ics:T0882
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6ed07095-c23a-4676-807f-a544deaeb274
McAfee Labs October 2019 · SecureWorks September 2019ATTACK:ics:S0496 → uses → ATTACK:ics:T1701.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--72a284ef-1b88-40b1-8ab0-af6e2911f7cd
Tom Fakterman August 2019ATTACK:ics:S0496 → uses → ATTACK:ics:T0828
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ab306654-2abb-4983-8d30-df4058adb06c
Selena Larson, Camille Singleton December 2020ATTACK:ics:S0496 → uses → ATTACK:ics:T1701.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b270a54c-2a59-46a1-a0b1-4e626bba0b25
Tom Fakterman August 2019ATTACK:ics:G0115 → uses → ATTACK:ics:S0496
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bff99f91-e1a9-4379-a2d9-5a99615a95d1
Secureworks REvil September 2019 · Secureworks GandCrab and REvil September 2019ATTACK:ics:S0496 → uses → ATTACK:ics:T0869
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c90cfddb-253b-41c8-9057-2abde6f8aa6d
SecureWorks September 2019 · Tom Fakterman August 2019ATTACK:ics:S0496 → uses → ATTACK:ics:T0886
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e323dee4-a896-4a82-85f5-d51d311b0437
Max Heinemeyer February 2020