Log in Request a demo

Malware profile

REvil

Also known as Sodinokibi, Sodin

REvil, also called Sodinokibi and Sodin, is ransomware for Windows.

In short

REvil, also called Sodinokibi and Sodin, is ransomware for Windows. It encrypts files and demands a ransom to get them back. MITRE describes it as a ransomware-as-a-service operation that has run since at least April 2019, and says it has been used against organizations in the manufacturing, transportation and electric sectors.

Last updated 8 October 2026

Profile MapMalware
  1. Names3names in public reportsREvil · Sodinokibi · Sodin
  2. Techniques16ATT&CK techniques listedInitial Access · Execution · Stealth
  3. Infection Steps5in the delivery chainMalicious code pushed out · Remote access established

In one minute

What it is
Ransomware for Windows that encrypts files and demands a ransom, run as a ransomware-as-a-service operation.
What it does
Encrypts files, deletes shadow copies and recovery options, stops services, and sends host details to its command servers.
Who uses it
MITRE links it to the group GOLD SOUTHFIELD. Attributed by the US Department of Justice (8 November 2021): attacks by two charged individuals, one of whom pleaded guilty and was sentenced in May 2024.
How it gets in
Malicious e-mail attachments, compromised websites and exploit kits, according to MITRE. CISA names the Pulse Secure VPN flaw CVE-2019-11510, and the July 2021 attack came through remote management software.
What to do first
Patch internet-facing systems, require multi-factor authentication, and keep offline backups, as CISA and the FBI advise.

What it does

MITRE says REvil is highly configurable and shares code similarities with the GandCrab ransomware-as-a-service. It has been used against organizations in the manufacturing, transportation and electric sectors.

US court documents describe the usual ending. The ransomware leaves a note as a text file with a link to a Tor website, where the victim gets a ransom demand. Victims who did not pay had their stolen data posted or said to be sold.

Names

Public sources use several names for this malware.

Names
NameWhere it appears
REvilMITRE ATT&CK software S0496[1]
SodinokibiMITRE Associated Software for S0496; also used by CISA and the US Department of Justice[1, 3, 5]
SodinMITRE Associated Software for S0496[1]

What it can do

What MITRE ATT&CK lists this malware as doing, by tactic. Each id opens our technique page where one exists, otherwise MITRE.

Initial Access

  • Phishing: Spearphishing Attachment T1566.001

    It has been sent out in malicious e-mail attachments, including Word documents.[1]

  • Drive-by Compromise T1189

    It has infected machines through compromised websites and exploit kits.[1]

Execution

  • User Execution: Malicious File T1204.002

    It has run after a user opened a malicious Word attachment from an e-mail.[1]

  • Command and Scripting Interpreter: PowerShell T1059.001

    It has used PowerShell to delete volume shadow copies and download files.[1]

  • Command and Scripting Interpreter: Visual Basic T1059.005

    It has used obfuscated VBA macros to run.[1]

  • Windows Management Instrumentation T1047

    It can use WMI to watch for and kill processes named in its configuration file.[1]

Stealth

  • Obfuscated Files or Information: Encrypted/Encoded File T1027.013

    It has used encrypted strings and configuration files.[1]

  • Execution Guardrails: Mutual Exclusion T1480.002

    It tries to create a mutex with a fixed value so only one copy runs on a host.[1]

Discovery

  • System Location Discovery: System Language Discovery T1614.001

    It checks the system language and ends the process if the language is on its list.[1]

Defense Impairment

  • Safe Mode Boot T1688

    It can force a reboot into safe mode with networking.[1]

Command and Control

  • Application Layer Protocol: Web Protocols T1071.001

    It has used HTTP and HTTPS to talk to its command servers.[1]

  • Encrypted Channel: Asymmetric Cryptography T1573.002

    It has encrypted command traffic with the ECIES algorithm.[1]

Exfiltration

  • Exfiltration Over C2 Channel T1041

    It can send host and malware information to command servers.[1]

Impact

  • Service Stop T1489

    It can stop services and kill processes.[1]

  • Inhibit System Recovery T1490

    It can use vssadmin to delete volume shadow copies and bcdedit to turn off recovery features.[1]

  • Data Encrypted for Impact T1486

    It can encrypt files on victim systems and demands a ransom to decrypt them.[1, 5]

How it spreads

MITRE lists two ways REvil has reached victims: malicious e-mail attachments, including Word documents, and compromised websites and exploit kits. CISA, the FBI and partner agencies note that multiple malware campaigns took advantage of the Pulse Secure VPN flaw CVE-2019-11510, most notably REvil/Sodinokibi. In July 2021 CISA and the FBI described a supply-chain attack that used a vulnerability in remote management software to push ransomware to the customers of managed service providers. A US indictment says the attacker pushed REvil code through that product to customer computers.

How an infection runs

The order of steps in a typical infection, as the sources describe it.

  1. Malicious code pushed out

    In the July 2021 attack, the indictment says the attacker caused REvil code to be deployed throughout a remote management product.[6]

  2. Remote access established

    The product then sent the ransomware to endpoints on customer networks. After remote access was set up, the ransomware was run on those computers.[6]

  3. Files encrypted

    Data on computers of organizations around the world that used the software was encrypted.[6]

  4. Ransom note left

    A text file on the computer gave a Tor web address and a public website address where the victim could recover files.[5, 6]

  5. Pay or be exposed

    Victims were given a ransom demand and a cryptocurrency address. Those who paid got a decryption key. Those who did not had stolen data posted or said to be sold.[5, 6]

Timeline

  1. April 2019

    Ransomware-as-a-service starts

    MITRE says REvil operated as ransomware-as-a-service since at least April 2019.[1]

  2. Aug. 16, 2019

    Texas attacks

    A US indictment says one charged individual attacked businesses and government entities in Texas on or about this date.[5]

  3. July 2, 2021

    Remote management supply-chain attack

    The US Department of Justice says the attack on a remote management software company, and its customers, took place on this date.[5, 6]

  4. July 06, 2021

    CISA and FBI guidance

    CISA and the FBI published guidance for managed service providers and customers hit by the attack. It was last revised on this date.[4]

  5. Oct. 8, 2021

    Arrest in Poland

    The Department of Justice says Yaroslav Vasinskyi was taken into custody in Poland.[5]

  6. November 8, 2021

    Indictment and seizure

    The Department of Justice unsealed an indictment against Vasinskyi and announced a seizure of $6.1 million tied to ransom payments received by a second charged individual.[5]

  7. March 9, 2022

    Extradited and arraigned

    Vasinskyi was arraigned in the Northern District of Texas after arriving in Dallas on March 3.[6]

  8. May 1, 2024

    Sentence

    Vasinskyi was sentenced to 13 years and seven months in prison and ordered to pay over $16 million in restitution.[7]

Detection and defense

  1. Patch internet-facing systems

    CISA's top exploited vulnerabilities advisory says to upgrade to the latest Pulse Secure VPN for CVE-2019-11510, which REvil campaigns took advantage of.[3]

    Counters: T1486

  2. Run the official detection tool

    For the July 2021 attack, CISA and the FBI point to a detection tool that checks a management server or managed endpoint for indicators of compromise. Advisory AA21-209A also lists detection steps for the Pulse Secure flaw.[3, 4]

    Counters: T1486

  3. Require multi-factor authentication

    CISA and the FBI advise enforcing multi-factor authentication on every account the organization controls, and on customer-facing services where possible.[4]

    Counters: T1486

  4. Restrict remote management tools

    Limit communication with remote management tools to known IP address pairs, or place their admin interfaces behind a VPN or a firewall on a dedicated admin network.[4]

    Counters: T1071.001

  5. Keep offline backups

    Keep backups up to date, easy to retrieve and air-gapped from the organization network. This helps recovery after files are encrypted and shadow copies deleted.[4]

    Counters: T1486 T1490

  6. Apply least privilege

    CISA and the FBI advise the principle of least privilege on key admin accounts, which limits what a stolen or abused token can do.[4]

    Counters: T1134.002

Questions

What is REvil?

Ransomware for Windows that MITRE describes as a ransomware-as-a-service operation active since at least April 2019. It is also called Sodinokibi and Sodin.

Who is behind REvil?

MITRE links it to the group GOLD SOUTHFIELD, which it says provides the backend infrastructure for affiliates. The US Department of Justice has charged individuals over REvil attacks, and one was sentenced in May 2024.

How did REvil reach the Kaseya customers in 2021?

The US Department of Justice says malicious REvil code was deployed through a remote management product, which then pushed the ransomware to endpoints on customer networks.

How does REvil get in?

MITRE lists malicious e-mail attachments and compromised websites with exploit kits. CISA names the Pulse Secure VPN flaw CVE-2019-11510 as one that REvil campaigns took advantage of.

What should defenders do first?

CISA and the FBI advise multi-factor authentication on every account, allowlisting or VPN protection for remote management tools, offline backups and least privilege.

In our research

  1. YES! Ransom Gangs Retarget Same Companies, Learn Why! October 2022
  2. Top Ransomware Groups and Monitoring Techniques July 2022

Sources

  1. REvil, Software S0496 MITRE ATT&CKSupports: Names, platform, description, techniques and the link to GOLD SOUTHFIELD.
  2. GOLD SOUTHFIELD, Pinchy Spider, Group G0115 MITRE ATT&CKSupports: The group that operates the REvil ransomware-as-a-service and its role for affiliates.
  3. Top Routinely Exploited Vulnerabilities (AA21-209A) CISA with ACSC, NCSC UK and FBISupports: CVE-2019-11510 Pulse Secure flaw taken advantage of by REvil/Sodinokibi.
  4. CISA-FBI Guidance for MSPs and their Customers Affected by the Kaseya VSA Supply-Chain Ransomware Attack CISA and FBISupports: July 2021 attack, detection tool and protective steps.
  5. Ukrainian Arrested and Charged with Ransomware Attack on Kaseya US Department of JusticeSupports: November 2021 indictments, seizure, ransom note and arrests.
  6. Sodinokibi/REvil Ransomware Defendant Extradited to United States and Arraigned in Texas US Department of JusticeSupports: How the July 2021 attack ran and the March 2022 arraignment.
  7. Sodinokibi/REvil Affiliate Sentenced for Role in $700M Ransomware Scheme US Department of JusticeSupports: May 2024 sentence and scale of attacks.

Browse the threat library

Keep exploring

Knowledge Hub

Glossary term

Ransomware

Ransomware is malware that encrypts files and systems so they become unusable until a ransom is paid.

Read more

Glossary term

Exploit kit

An exploit kit is a toolset that tries to find a weakness in a visitor's browser or plugins and then delivers exploit code to use it.

Read more