Sodinokibi

Sodinokibi, also known as REvil, is a significant threat actor first identified in April 2019. This ransomware family operates as a Ransomware-as-a-Service (RaaS) and has been responsible for one in three ransomware incidents responded to by IBM Security X-Force in 2020. The Sodinokibi ransomware strain was the most frequently observed by IBM Security X-Force in that year, capitalizing on blended ransomware and extortion attacks. Notably, at least 32% of Sodinokibi ransomware victims have had their data leaked by those operating this ransomware. The Sodinokibi ransomware has been delivered through various methods, including fileless techniques used by GootLoader. It has been linked with other significant threats such as SunCrypt ransomware, Kronos trojans, and Cobalt Strike. Notable instances of its deployment include an attack on Alameda County, California, where it was used to encrypt data, exfiltrate victim information, and extort a ransom payment. Throughout 2021, authorities arrested several individuals connected to the REvil and GandCrab RaaS operations, believed to be operated by the same group. Sodinokibi's influence extends to connections with other major ransomware groups. In early 2023, it was reported that the leader of LockBit had connections to the leader of REvil - Sodinokibi - as well as DarkSide, which hit Colonial Pipeline and later evolved into BlackMatter and Alphv, aka BlackCat. The group has drawn significant attention from U.S. authorities due to high-profile attacks, including a 2021 hack of IT management service Kaseya and multiple Texas towns in 2019. Over the last two years, the State Department has offered rewards up to $15 million for information leading to the location of members of the Sodinokibi (REvil), Conti, and DarkSide ransomware networks.