Log in Request a demo

Ransomware group profile

REvil ransomware group

Also known as Sodinokibi, Sodin

REvil, also called Sodinokibi, is a ransomware as a service operation that MITRE ATT&CK says ran since at least April 2019.

  • Disrupted

In short

REvil, also called Sodinokibi, is a ransomware as a service operation that MITRE ATT&CK says ran since at least April 2019. The U.S. Department of Justice says it was used in thousands of attacks, including the July 2021 attack on Kaseya, an IT software company, that reached its customers. Between November 2021 and May 2024 the United States sanctioned, charged, extradited and sentenced people tied to it.

Profile MapRansomware Group
  1. StatusDisruptedas reported
  2. Other Names2names in public reportsSodinokibi · Sodin
  3. Entry Routes3ways inPhishing with Word attachments
  4. Techniques3mapped to MITRE ATT&CKData Encrypted for Impact · Remote Services
  5. Defences6first steps listedKeep backups offline · Patch by the vendor's guidance

Overview

REvil, also known as Sodinokibi, is a ransomware family run as a ransomware as a service (RaaS). In a RaaS, a core team builds the ransomware and affiliates deploy it. MITRE ATT&CK says it operated this way since at least April 2019 and shares code similarities with GandCrab. It has been used against organizations in the manufacturing, transportation and electric sectors.

The Kaseya attack

On July 2, 2021 a supply-chain attack hit Kaseya VSA, remote management software used by managed service providers (MSPs), which are firms that run IT for other companies. CISA and the FBI say the attack used a flaw in VSA against multiple MSPs and their customers. The Department of Justice says malicious REvil code was pushed through a Kaseya product to endpoints on customer networks, which led to data being encrypted at organizations around the world. Treasury says the attack caused significant disruption to Kaseya’s customer base.

REvil and the law
  1. April 2019Operating as a RaaSMITRE ATT&CK dates REvil activity to at least this month.
  2. July 2, 2021Kaseya attackThe Department of Justice dates the Kaseya attack to this day.
  3. October 8, 2021Arrest in PolandA Ukrainian national is taken into custody in Poland, per the Department of Justice.
  4. November 8, 2021Charges, seizure, sanctionsThe Department of Justice unseals an indictment and announces a 6.1 million US dollar seizure. Treasury sanctions two operators, and a reward offer is announced.
  5. March 9, 2022Extradited and arraignedThe defendant appears in a Texas court after extradition from Poland.
  6. 2023ForfeitureThe Department of Justice obtains final forfeiture of ransom proceeds.
  7. May 1, 2024Sentence13 years and seven months in prison and over 16 million US dollars in restitution.

Scale as officials state it

The Department of Justice says the sentenced defendant carried out over 2,500 ransomware attacks and demanded over 700 million US dollars. Treasury says the wider group received more than 200 million US dollars in ransom. FinCEN, the U.S. financial crimes unit, names REvil/Sodinokibi among the most commonly reported ransomware variants in its review of 2021 reports. These figures come from different documents and counting methods.

Law enforcement action, 2021 to 2024

On November 8, 2021 the Department of Justice announced an indictment against one Ukrainian national, a 6.1 million US dollar seizure tied to a second defendant, a Russian national, and the arrests of two other REvil actors in Romania. Treasury sanctioned the two operators and a virtual currency exchange that facilitated payments for ransomware actors. The State Department’s offer, announced the same day, was up to 10 million US dollars for people in key leadership roles and up to 5 million for anyone who took part in a REvil incident. The Ukrainian defendant was extradited from Poland and arraigned in Texas on March 9, 2022, pleaded guilty to an 11-count indictment, and was sentenced on May 1, 2024.

How it works

MITRE ATT&CK records that REvil spreads by phishing emails with Word attachments and by compromised websites and exploit kits. Once on a machine it stops services and processes, deletes the built-in Windows restore points, and encrypts files, including files on network shares over the SMB protocol.

At a glance
Also known as
Sodinokibi, Sodin
Operating since
At least April 2019 (MITRE ATT&CK)
Best known for
Kaseya attack, July 2, 2021
Attacks by sentenced defendant
Over 2,500 (Department of Justice)
Ransom demanded
Over 700 million USD by that defendant
Group proceeds
More than 200 million USD (Treasury)
Rewards offered
Up to 10 million and up to 5 million USD

Also known as

  • Sodinokibi
  • Sodin

How they get in

  1. 01

    Phishing with Word attachments

    MITRE ATT&CK says REvil has been distributed through malicious email attachments, including Word documents.

  2. 02

    Compromised websites and exploit kits

    MITRE ATT&CK records infections of victim machines through compromised websites and exploit kits.

  3. 03

    Supply chain through management software

    In July 2021 attackers pushed REvil through a vulnerability in Kaseya VSA, so that managed service providers and their customers received the ransomware.

How they extort

Double extortion, per the Department of Justice: data was encrypted and victims who did not pay saw their data exposed. Ransoms were demanded in cryptocurrency, and the group used exchangers and mixing services to hide the proceeds. Treasury says the group received more than 200 million US dollars in Bitcoin and Monero.

Who they target

  1. 01

    Technology and managed service providers

    See the industry page
  2. 02

    Manufacturing

    See the industry page
  3. 03

    Energy and electric utilities

    See the industry page
  4. 04

    Transportation

  5. 05

    Government and public sector

    See the industry page

How to defend

  1. Use multifactor authentication on every account

    CISA and the FBI advise MSPs to enforce multifactor authentication on every account they control, and on customer-facing services where possible.

  2. Protect remote management tools

    Place administrative interfaces of remote monitoring and management software behind a VPN or a firewall on a dedicated administrative network, and limit which addresses can reach them.

  3. Keep backups offline

    Make sure backups are current and stored where they are easy to restore from and cut off from the main network.

  4. Patch by the vendor's guidance

    CISA and the FBI advise a manual patch process that follows vendor guidance and installs new patches as soon as they are released.

  5. Limit admin rights

    Apply the principle of least privilege on key administrator accounts.

  6. Watch for recovery tampering

    MITRE ATT&CK notes REvil uses vssadmin and bcdedit to delete restore points and disable recovery. Alert on these commands.

Questions

What is REvil?

REvil, also called Sodinokibi, is a ransomware as a service operation that MITRE ATT&CK says has run since at least April 2019. A core team builds the ransomware and affiliates deploy it.

What was the Kaseya attack?

On July 2, 2021 a supply-chain attack used a flaw in Kaseya VSA, remote management software used by managed service providers, to push REvil to their customers. Data was encrypted at organizations around the world.

Was anyone arrested or sentenced for REvil?

Yes. The Department of Justice says a Ukrainian national was arrested in Poland on October 8, 2021, extradited, and sentenced on May 1, 2024 to 13 years and seven months in prison.

How does REvil spread?

MITRE ATT&CK records spread through phishing emails with Word attachments, compromised websites and exploit kits. It then stops services, deletes Windows restore points and encrypts files, including network shares over SMB.

How can organizations defend against REvil?

CISA and the FBI advise multifactor authentication on every account, remote management tools behind a VPN or firewall, offline backups, vendor-guided patching and least privilege on administrator accounts.

In our research

  1. Understanding Supply Chain Attack Tactics with Case Study October 2025
  2. Why Does Ransomware Still Threaten Cybersecurity? June 2025
  3. DarkSide Ransomware Technical Analysis Open Report July 2023
  4. Cybersecurity Trends in 2023: What You Need to Know April 2023
  5. YES! Ransom Gangs Retarget Same Companies, Learn Why! October 2022
  6. European Focused Threat Actors – Ransomware Groups September 2022

Sources

  1. REvil, Software S0496 MITRE ATT&CK
  2. Kaseya VSA Supply-Chain Ransomware Attack CISA
  3. CISA-FBI Guidance for MSPs and their Customers Affected by the Kaseya VSA Supply-Chain Ransomware Attack CISA, FBI
  4. Justice Department Seizes $6.1 million Related to Alleged Ransomware Extortionists U.S. Department of Justice
  5. Sodinokibi/REvil ransomware defendant extradited to the United States and arraigned in Texas U.S. Department of Justice
  6. Sodinokibi/REvil affiliate sentenced for role in $700M ransomware scheme U.S. Department of Justice
  7. Treasury Continues to Counter Ransomware as Part of Whole-of-Government Effort U.S. Department of the Treasury
  8. Financial Trend Analysis: Ransomware FinCEN

Last updated October 2026

Browse the threat library

Keep exploring

Knowledge Hub

Threat group

FIN7

Attributed by the US Department of Justice to a financially motivated criminal conspiracy of dozens of computer specialists, FIN7 is described in US court papers as stealing tens of millions of payment card records from US businesses, and the FBI has warned about its mailed USB devices used to deliver ransomware. It hacks company networks to steal card data and, in later years, to deploy ransomware.

Read more

Glossary term

Ransomware-as-a-service (RaaS)

Ransomware-as-a-service is a business model in which a core group maintains ransomware and lets other criminals, called affiliates, use it to attack victims.

Read more