top of page
Sodinokibi
Name
Category
Type
Targeted OS
Description
Information
Sodinokibi
Sodin
REvil
Malware
Ransomware
Big Game Hunting
Windows & Linux
(Cybereason) The ransomware iterates through all folders on the machine, encrypts all files, and drops a ransom note in each folder. Once it has finished encryption, it changes the desktop wallpaper to help inform the user of the attack.
https://www.cybereason.com/blog/the-sodinokibi-ransomware-attack
https://blog.intel471.com/2020/05/04/changes-in-revil-ransomware-version-2-2/
https://www.bleepingcomputer.com/news/security/revil-ransomware-scans-victims-network-for-point-of-sale-systems/
https://www.tripwire.com/state-of-security/security-data-protection/cyber-security/revil-ryuk-tycoon-ransomware/
https://www.bleepingcomputer.com/news/security/revil-ransomware-has-a-new-windows-safe-mode-encryption-mode/
https://www.tripwire.com/state-of-security/featured/revil-ransomware-what-you-need-to-know/
https://www.cybereason.com/blog/cybereason-vs.-revil-ransomware
https://www.bleepingcomputer.com/news/security/revil-ransomwares-new-linux-encryptor-targets-esxi-virtual-machines/
https://cybersecurity.att.com/blogs/labs-research/revils-new-linux-version
https://www.databreaches.net/still-think-you-can-negotiate-with-revil-and-get-your-files-back-read-this-first/
https://www.cybereason.com/blog/cybereason-vs-revil-ransomware-the-kaseya-chronicles
https://www.bankinfosecurity.com/blogs/theres-clear-line-from-revil-ransomware-to-russia-p-3065
https://www.mcafee.com/blogs/other-blogs/mcafee-labs/revil-ransomware-uses-dll-sideloading/
https://www.elliptic.co/blog/revil-revealed-tracking-ransomware-negotiation-and-payment
https://www.bleepingcomputer.com/news/security/kaseya-obtains-universal-decryptor-for-revil-ransomware-victims/
https://www.flashpoint-intel.com/blog/possible-universal-revil-master-key-posted-to-xss/
https://blogs.cisco.com/security/threat-protection-the-revil-ransomware
https://securityintelligence.com/posts/sodinokibi-ransomware-incident-response-intelligence-together/
https://www.bleepingcomputer.com/news/security/free-revil-ransomware-master-decrypter-released-for-past-victims/
https://www.malvuln.com/advisory/7d7ee58c2696794b3be958b165eb61a9.txt
https://www.secureworks.com/blog/revil-development-adds-confidence-about-gold-southfield-reemergence
Malpedia
Alienvault OTX
Playbook
https://pan-unit42.github.io/playbook_viewer/?pb=revil-ransomware
https://www.nomoreransom.org/uploads/REvil_documentation.pdf
CISA
Other Information
Mitre
Mitre Techniques
Mitre Techniques Navigator Link
NIL
NIL
['T1134', 'T1071', 'T1059', 'T1485', 'T1486', 'T1140', 'T1189', 'T1573', 'T1041', 'T1083', 'T1562', 'T1070', 'T1105', 'T1490', 'T1036', 'T1112', 'T1106', 'T1027', 'T1069', 'T1566', 'T1055', 'T1012', 'T1489', 'T1082', 'T1614', 'T1007', 'T1204', 'T1047', 'T0828', 'T0849', 'T0886', 'T0853', 'T0881', 'T0869', 'T0882', 'T0863']
bottom of page