RansomwareATT&CK S0496
REvil
Also known as: Sodinokibi, Sodin
REvil, also called Sodinokibi, was a ransomware-as-a-service operation behind several of the most disruptive attacks of 2021, including the July 2021 attack that pushed ransomware through Kaseya's VSA remote-management software to managed service providers and their customers. Law enforcement actions in late 2021 led to arrests of affiliates.
- Public attribution and associated actors
- Run as ransomware-as-a-service. MITRE ATT&CK lists it as used by GOLD SOUTHFIELD and FIN7. In 2021 the US Department of Justice charged a Ukrainian national over the Kaseya attack carried out with REvil.As publicly reported:GOLD SOUTHFIELDFIN7
- First seen
- Around 2019
- Platforms
- Windows
- MITRE ATT&CK software entries
- S0496 REvil
Status: Affiliates arrested in 2021 operations coordinated by Europol, and a suspect charged by the US Department of Justice over the Kaseya attack (reported).
How it spreads or gets in
- Delivered by affiliates through phishing attachments, compromised websites (drive-by), exploited software and remote access.
- Abused trusted IT management software in the 2021 Kaseya VSA supply-chain attack.
Key behaviours
- Exfiltrated data before encrypting it and threatened publication.
- Used PowerShell and token manipulation to run with higher privileges.
- Deleted shadow copies and stopped services.
ATT&CK techniques
- T1566.001Phishing: Spearphishing Attachment
- T1189Drive-by Compromise
- T1059.001Command and Scripting Interpreter: PowerShell
- T1134.001Access Token Manipulation: Token Impersonation/Theft
- T1041Exfiltration Over C2 Channel
- T1486Data Encrypted for Impact
- T1490Inhibit System Recovery
Selected from the family's MITRE ATT&CK software entry.
Detection ideas
- Monitor remote-management platforms for unexpected scripts or deployments to many endpoints at once.
- Alert on encoded PowerShell launched by Office applications or management agents.
- Detect shadow-copy deletion and mass file renames.
Defences that work
- Harden and isolate remote-management tools, and require MFA for their consoles.
- Patch internet-facing software quickly.
- Constrain PowerShell with logging and application control.
- Keep offline, tested backups.