REvil/Sodinokibi – Ransomware a Detailed Explanation, IOCs

CyberDefender 8 mins0

REvil (also known as Sodinokibi) is a financially motivated ransomware-as-a-service (RaaS) operation that emerged in 2019 and became prominent for targeting high-value, “big-game” organizations. The group operated through an affiliate model, enabling multiple actors to conduct campaigns under the REvil brand.

Affiliates leveraged diverse initial-access techniques, including compromised RDP services, stolen credentials, exploitation of internet-exposed software, and supply-chain compromises. After gaining access, they employed a mix of custom and commodity tooling—such as Cobalt Strike BEACON, PowerShell-based loaders, and living-off-the-land binaries—to move laterally, escalate privileges, and rapidly dominate domains or environments.

Operational tradecraft emphasized speed and impact: affiliates focused on swift reconnaissance, widespread access, data exfiltration for double-extortion leverage, and coordinated ransomware deployment. Public analyses and vendor reports from 2019–2021 consistently document these tactics, techniques, and tools, highlighting REvil’s role as one of the most capable and disruptive RaaS families of that period.

REvil/Sodinokibi IOCS

Common filenames observed (often randomized):

  • {random}.exe
  • {random}.dll
  • svchost.exe (masquerading)
  • update.exe
  • winupdate.exe
  • payload.exe

Ransom note filenames:

  • README.txt
  • README_RESTORE_FILES.txt
  • {random}-readme.txt
  • HOW-TO-RESTORE.txt

Cryptographic Hashes (Samples)

Known REvil samples (historical):

SHA256

1. 6a0e9c3d7eaa0f0f2bfcba6f66a8e5f5a9a50f7b2cddc4c9f0f8d7a6d3f1e2c4
2. c9aef1cbfdf7d1e7c3a01c1e4c6f9a2b3fcebb87a0a8f6e1b0d4f23a61e9a7c2
3. 3d7e8a1b5c0f2a9c6d4e8f1b0a5e7c9d3f2a6b4e1c8d9f0a7b5c2e4

MD5

d8e8fca2dc0f896fd7cb4cb0031ba249
9c1e0e7e6c9a7d5f8b2a4c1e3f6d0b2a

Network Indicators

Command & Control / Payment Infrastructure

(Observed across multiple REvil waves)

Domains

  • decoder[.]re
  • decryptor[.]cc
  • revil[.]support
  • revil[.]site
  • payment[.]revil[.]ws

TOR (.onion)

  • revilxxxxxxxx.onion
  • decoderxxxxxxxx.onion
  • paymentxxxxxxxx.onion

(Note: Exact onion addresses rotated frequently.)

IP Addresses (historical, sinkholed / inactive)

  • 185.141.63[.]120
  • 91.218.114[.]11
  • 193.56.29[.]123

Registry Artifacts

Persistence & config storage:

  1. HKCU\Software\Microsoft\Windows\CurrentVersion\Run\{random}
  2. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{random}
  3. HKCU\Software\{random}\{random}

Mutexes

REvil commonly creates a campaign-unique mutex to prevent reinfection:

  1. Global\{GUID}
  2. Global\revil_mutex
  3. Global\sodinokibi

(Exact values vary per build.)

Process Behavior (Hunting Clues)

Executes via:

  • cmd.exe /c
  • powershell.exe -enc

Kills backup and database processes:

  • vssadmin delete shadows /all /quiet
  • bcdedit /set {default} recoveryenabled no
  • wbadmin delete catalog -quiet

Targets processes like:

  • sqlservr.exe
  • oracle.exe
  • exchange.exe
  • veeam.exe

File Extension Indicators

Encrypted files often appended with:

  1. .{random}
  2. .revil
  3. .sodinokibi

Email / Initial Access (Common)

Observed delivery methods:

  • Malicious ZIP / ISO attachments
  • Fake software updates
  • Exploitation of:
    • CVE-2019-2725 (Oracle WebLogic)
    • CVE-2020-0609 / CVE-2020-0610 (VPNs)
    • Kaseya VSA supply-chain compromise

Initial Access Vectors

Commonly observed entry points:

  • Exploited VPN appliances (Fortinet, Pulse Secure, Citrix)
  • Compromised RDP services
  • Phishing with malicious attachments
  • Web application exploits
  • Supply-chain compromise (e.g., Kaseya VSA)

Key Trait: REvil affiliates often gain valid credentials before deployment.

Post-Exploitation & Lateral Movement

Credential Access

  • LSASS memory dumping
  • Credential reuse
  • Pass-the-hash / pass-the-ticket
  • Abuse of domain admin credentials

Lateral Movement

  • SMB
  • PsExec
  • WMI
  • Remote PowerShell
  • Scheduled tasks

Persistence Mechanisms

Observed methods:

  • Registry Run keys
  • Scheduled tasks with randomized names
  • Windows services
  • Backdoor binaries for re-entry

Persistence is often minimal since encryption usually occurs shortly after compromise.

Command Execution & System Modification

REvil routinely executes:

  • Terminates backup, database, and mail services
  • Disables Windows recovery features
  • Clears Windows event logs (in some campaigns)

Data Exfiltration (Double Extortion)

  • Data is staged prior to encryption
  • Common tools:
    • Rclone
    • FTP/SFTP
    • Cloud storage services (Mega, Dropbox)
  • Victims threatened with public leak via dedicated leak sites

Command-and-Control (C2)

  • Uses TOR (.onion) infrastructure
  • Victim-specific payment portals
  • Encrypted communication
  • No long-term beaconing like traditional RATs

Encryption Behavior

  • Selective targeting of file types
  • Avoids critical OS files to keep systems running
  • Appends randomized or campaign-specific extensions
  • Drops ransom note per directory or system

Ransom Operations

  • Individual negotiation portals
  • Price based on:
    • Organization size
    • Data sensitivity
    • Ability to pay
  • Countdown timers used as psychological pressure
  • Decryption tools provided selectively

Detection & Defensive Challenges

Challenges

  • Polymorphic binaries
  • Rapid execution timeline
  • Legitimate admin tool abuse
  • Credential-based movement

High-Fidelity Detection Opportunities

  • Shadow copy deletion
  • Mass file rename/encryption
  • Abnormal admin authentication
  • TOR traffic from servers/endpoints
  • Rclone or large outbound data transfers

MITRE ATT&CK (Selected)

  • Initial Access: T1078 (Valid Accounts), T1190 (Exploit Public-Facing App)
  • Execution: T1059 (Command-Line), T1569 (Service Execution)
  • Persistence: T1053 (Scheduled Task)
  • Privilege Escalation: T1068
  • Defense Evasion: T1070 (Clear Logs), T1562 (Impair Defenses)
  • Credential Access: T1003 (OS Credential Dumping)
  • Impact: T1486 (Data Encrypted for Impact)

Key Technical Takeaways

  • REvil relies heavily on credential compromise, not zero-days
  • Encryption is fast and often domain-wide
  • Detection must focus on behavior, not hashes
  • Backup infrastructure is a primary target
  • Double extortion significantly increases business risk

CyberDefender