Sodinokibi
Description
(Cybereason) The ransomware iterates through all folders on the machine, encrypts all files, and drops a ransom note in each folder. Once it has finished encryption, it changes the desktop wallpaper to help inform the user of the attack.
Names
| Name |
|---|
| Sodinokibi |
| Sodin |
| REvil |
Category
Malware
Type
- Ransomware
- Big Game Hunting
Information
- https://www.cybereason.com/blog/the-sodinokibi-ransomware-attack
- https://blog.intel471.com/2020/05/04/changes-in-revil-ransomware-version-2-2/
- https://www.bleepingcomputer.com/news/security/revil-ransomware-scans-victims-network-for-point-of-sale-systems/
- https://www.tripwire.com/state-of-security/security-data-protection/cyber-security/revil-ryuk-tycoon-ransomware/
- https://www.bleepingcomputer.com/news/security/revil-ransomware-has-a-new-windows-safe-mode-encryption-mode/
- https://www.tripwire.com/state-of-security/featured/revil-ransomware-what-you-need-to-know/
- https://www.cybereason.com/blog/cybereason-vs.-revil-ransomware
- https://www.bleepingcomputer.com/news/security/revil-ransomwares-new-linux-encryptor-targets-esxi-virtual-machines/
- https://cybersecurity.att.com/blogs/labs-research/revils-new-linux-version
- https://www.databreaches.net/still-think-you-can-negotiate-with-revil-and-get-your-files-back-read-this-first/
- https://www.cybereason.com/blog/cybereason-vs-revil-ransomware-the-kaseya-chronicles
- https://www.bankinfosecurity.com/blogs/theres-clear-line-from-revil-ransomware-to-russia-p-3065
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/revil-ransomware-uses-dll-sideloading/
- https://www.elliptic.co/blog/revil-revealed-tracking-ransomware-negotiation-and-payment
- https://www.bleepingcomputer.com/news/security/kaseya-obtains-universal-decryptor-for-revil-ransomware-victims/
- https://www.flashpoint-intel.com/blog/possible-universal-revil-master-key-posted-to-xss/
- https://blogs.cisco.com/security/threat-protection-the-revil-ransomware
- https://securityintelligence.com/posts/sodinokibi-ransomware-incident-response-intelligence-together/
- https://www.bleepingcomputer.com/news/security/free-revil-ransomware-master-decrypter-released-for-past-victims/
- https://www.malvuln.com/advisory/7d7ee58c2696794b3be958b165eb61a9.txt
- https://www.secureworks.com/blog/revil-development-adds-confidence-about-gold-southfield-reemergence
Mitre Attack
Malpedia
Alienvault Otx
Playbook
- https://pan-unit42.github.io/playbook_viewer/?pb=revil-ransomware
- https://www.nomoreransom.org/uploads/REvil_documentation.pdf
Other Information
Uuid
abd10b51-212f-4403-a7df-328238d3df19
Last Card Change
2022-12-30