REvil

MITRE G0106Also known as Sodinokibi

Reports

First seen

Jul 13

Last seen

Apr 6

Motivation

financial, Financial extortion

Targeting

Sectors

technology ×2

Victim regions

United States ×2Germany ×1

Top ATT&CK techniques

T1190 Exploit Public-Facing Application ×7T1486 Data Encrypted for Impact ×4T1195 Supply Chain Compromise ×2T1570 Lateral Tool Transfer ×1T1140 Deobfuscate/Decode Files or Information ×1T1078 Valid Accounts ×1T1036 Masquerading ×1T1218.011 Signed Binary Proxy Execution — Certutil ×1T1059 Command and Scripting Interpreter ×1T1657 Financial Theft ×1T1556 Modify Authentication Process ×1T1195.003 Supply Chain Compromise: Software Supply Chain Compromise ×1

Indicators

filename ×5cve ×2email ×1

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2021-30116 (exploited)CVE-2021-30117 CVE-2021-30119 (exploited)

Recent reports

High

Germany Identifies UNKN as Leader of REvil and GandCrab Ransomware Groups

KrebsOnSecurityApr 6 Critical

Progressive Computing's Response to Kaseya VSA REvil Ransomware Supply-Chain Attack

Huntress BlogAug 23 Critical

Lessons Learned During the Kaseya VSA Supply Chain Attack

Huntress BlogJul 28 Critical

Analysis of Kaseya VSA Mass Ransomware Campaign Origins and Limited Attack Surface

Huntress BlogJul 20 Critical

Huntress VSA Vaccine: Proactive Protection Against REvil Kaseya Supply Chain Attack

Huntress BlogJul 13

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.