Sodinokibi

Sodinokibi, universally known by its alias REvil (Ransomware Evil), is a ransomware-as-a-service (RaaS) family that emerged in April 2019 as the successor to GandCrab. Its operators offered the ransomware encryptor and negotiation infrastructure to affiliates on a profit-sharing model, retaining approximately 20-30 per cent of ransom proceeds while affiliates handled access acquisition and victim targeting. Sodinokibi became the highest-profile ransomware family of 2020-2021, responsible for the $11 million JBS Foods attack in May 2021, the Kaseya VSA supply-chain attack in July 2021 (encrypting an estimated 1,500 downstream businesses simultaneously), and multiple attacks on law firms, government contractors and healthcare organisations. Multiple victims paid ransoms exceeding $1 million. In January 2022, Operation GoldDust saw the FBI, Europol and partners arrest several REvil affiliates in Russia and Ukraine and seize Cryptocurrency. The group's infrastructure collapsed in early 2022.

Whether current Sodinokibi deployments represent resurgent original operators, copycat groups using leaked source code, or affiliates who moved to successor RaaS platforms remains publicly unconfirmed. In the cyber-threats-and-defences topic, Sodinokibi payloads were delivered via CVE-2024-21182, an unauthenticated flaw in Oracle WebLogic Server, from mid-May 2026, 17 months after Oracle patched the vulnerability. CISA listed the flaw as actively exploited with a Sodinokibi payload on 1 June 2026.

Sodinokibi's technical signature includes a customisable configuration file, double-extortion (encryption plus data exfiltration), and a negotiation portal operated on Tor. The original group operated a public-facing blog (the "Happy Blog") where it posted victim data as leverage. The RaaS model means that the Sodinokibi brand can persist or re-emerge independently of any specific operator arrests, as the encryptor and affiliate playbooks may survive the disruption of the core team.