Revil

Inactive
Sodinokibi ransomware group also known as REvil (Ransomware Evil) operates as a ransomware-as-a-service (RaaS) model. After the group compromised his victims, they would threaten to publish the victim's sensitive data on their darknet blog named 'Happy Blog', unless the ransom is paid. The ransomware malware code used by REvil is pretty similar to the ransomware code used by DarkSide - a different threat actor. REvil group claims to steal information after a successful attack on the supplier of the tech giant Apple and stole confidential schematics of their upcoming products.
96 Victims
Aug 25, 2019 First Discovered
Nov 28, 2022 Last Discovered
1433 Days Inactive
0% Infostealer
0/3 Sites Online
Known Locations (3)
404 Not Found
aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion
Blog
blogxxu75w63ujqarv476otld7cyjkq4yoswzt4ijadkjwvg3vrvd5yd.onion
404 Not Found
dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion
Tools Used
DiscoveryEnum
AdFind, Bloodhound
Exfiltration
PrivatLab, RClone, Sendspace
LOLBAS
BITSAdmin
Offsec
Cobalt Strike
Intelligence
Victims (96)

Detailed victim list temporarily unavailable

This group has 96 victims. The victim list API is currently responding slowly for this dataset. Country, sector, and infostealer breakdowns are not available at this time. Basic stats (victim count, first/last seen) are shown above from a faster data source.