Sodinokibi

Sodinokibi, also known as REvil, is a highly active and impactful threat actor first identified in April 2019. Operating as a ransomware-as-a-service (RaaS), this group has been responsible for a significant proportion of global ransomware incidents. In 2020, Sodinokibi ransomware attacks accounted for one in three ransomware incidents that IBM Security X-Force responded to, making it the most frequently observed strain by the organization that year. The group's operations have been characterized by blended ransomware and extortion attacks, with data leakage occurring in at least 32% of Sodinokibi's ransomware victims. The group has been linked to other notorious ransomware gangs such as LockBit and DarkSide, the latter being responsible for the high-profile Colonial Pipeline attack. These connections suggest a network of collaboration among some of the most destructive cybercrime entities. Despite being targeted by Russia under U.S. pressure, Sodinokibi continued its operations, often utilizing sophisticated delivery methods such as fileless techniques employed by GootLoader to deliver its ransomware, along with other threats like SunCrypt ransomware, Kronos trojans, and Cobalt Strike. Throughout 2021, efforts to disrupt Sodinokibi's operations led to multiple arrests associated with the group by Europol and South Korean authorities. Notably, an individual named Kondratyev was charged with using the Sodinokibi ransomware variant for data encryption, victim information exfiltration, and ransom extortion from a corporate victim based in Alameda County, California. Furthermore, the U.S. State Department offered rewards up to $15 million for information leading to the identification of members of the Sodinokibi network, reflecting the high level of threat posed by this group.