Sodin

Sodin, also known as Sodinokibi or REvil, is a sophisticated threat actor that emerged in the first half of 2019. This entity quickly drew attention due to its unique methods of distribution and attack. It exploited an Oracle Weblogic vulnerability to distribute itself and targeted Managed Service Providers (MSPs). Additionally, it was discovered that Sodin utilized the CVE-2018-8453 vulnerability to elevate privileges in Windows, a tactic rare among ransomware. This Trojan employs legitimate processor functions to evade security solutions, further demonstrating its advanced capabilities. The Sodin configuration is intricate, containing various fields necessary for the Trojan's operation. These settings and data are stored in encrypted form within each Sodin sample's body. A key element of this configuration is the 'pk' field, which represents the 32-byte public key of the Trojan distributor and is saved under the name 'sub_key' in the registry. Another part of the Sodin configuration is responsible for network communication, while a hybrid scheme is used to encrypt victim files. Sodin has been linked to several high-profile attacks since its emergence and may be connected to GandCrab, a prominent threat actor from 2018. Its geographical spread and impact have been significant, with its tactics evolving to include double and triple extortion, akin to other rising ransomware operators such as DarkSide, Maze, Clop, NetWalker, and Conti. This evolution underscores the growing sophistication and audacity of these cyber threats.