What is REvil (Sodinokibi) Ransomware?

REvil (Sodinokibi) Ransomware

malware OpenTrojan Threat Intelligence Updated 2026-08-26

Managed service providers and large enterprises; double extortion

Source Attribution

Origin: MITRE
Source: CISA · FBI advisory
Reviewer: Phase 44E review
Verified: 2026-08-26T15:16:26.825Z
Confidence: high

Source: CISA · FBI advisory · Verified: 2026-08-26T15:16:26.825Z · Confidence: high

Security Timeline

2019-04 discovered Sodinokibi first observed
2021-07 exploited Kaseya VSA supply-chain ransomware attack
2022-01 updated Group infrastructure dismantled

Quick Answer

REvil operators breach targets via supplier compromise or stolen credentials, exfiltrate data and encrypt systems, demanding ransom under the "Happy Blog" leak site.

Definition

REvil/Sodinokibi is an RaaS family that exploited managed service providers (Kaseya VSA) and conducted high-profile double-extortion attacks.

Overview

REvil/Sodinokibi is an RaaS family that exploited managed service providers (Kaseya VSA) and conducted high-profile double-extortion attacks.

Behavior

Kaseya VSA supply-chain compromise
Happy Blog leak site
RaaS affiliate model

First Seen

2019-04

Target

Managed service providers and large enterprises; double extortion

Techniques: T1486, T1567, T1490
Campaigns: kaseya-revil-supply-chain
Related CVEs: CVE-2021-30116, CVE-2021-44228

Malware Intelligence

Family: REvil (Sodinokibi) Ransomware

Aliases: Sodinokibi, REvil

Techniques: T1486, T1567, T1490

Targets: Managed service providers and large enterprises; double extortion

Behavior:

Kaseya VSA supply-chain compromise
Happy Blog leak site
RaaS affiliate model

References

Have a follow-up question?

Ask OpenTrojan's evidence-backed assistant about this topic — answers cite their sources.

Ask AI about this Start an investigation

Start Investigation

Move from reading to investigating REvil (Sodinokibi) Ransomware. The workspace is a structured analysis surface — not a chat — organised as:

Question — what do you need to know about REvil (Sodinokibi) Ransomware?

Evidence — assertions mapped to verifiable references.

Timeline — events in chronological order.

Related Entities — CVE, threat actor, campaign, malware links.

Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.

Notes — your own observations and working hypotheses.

AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.