Sodinokibi
Sodinokibi (also known as REvil) is a ransomware-as-a-service family responsible for multiple high-profile attacks, delivered here via exploited WebLogic T3/IIOP channels.
Sodinokibi, the ransomware sold under the REvil name, turned up in honeypot captures from mid-May 2026 as a payload for an already-patched Oracle WebLogic Server flaw, which CISA listed as actively exploited on 1 June.
Last refreshed: 12 October 2026 · Appears in 1 active topic
Is REvil ransomware back, and how is it reaching its victims in 2026?
Timeline for Sodinokibi
Abused Kaseya VSA zero-day in 2021
Cybersecurity: Threats and Defences: Mentioned in: CISA flags N-central flaw as exploitedDeployed onto compromised WebLogic servers via T3/IIOP exploit chain
Cybersecurity: Threats and Defences: WebLogic flaw revived as ransomware vectorBackground
Sodinokibi, better known as REvil (Ransomware Evil), appeared in April 2019 as the successor to GandCrab. Its core operators rented the encryptor and negotiation infrastructure to affiliates, keeping roughly 20 to 30 per cent of each ransom while affiliates found access and chose victims.
In 2020 and 2021 it was the highest-profile ransomware family in the world. Its operators extracted $11m from JBS Foods in May 2021, and in July 2021 they pushed the encryptor through Kaseya VSA to an estimated 1,500 downstream businesses at once. Several victims paid more than $1m, among them law firms, government contractors and healthcare groups. The group's infrastructure collapsed in early 2022.
Sodinokibi's signature is a customisable configuration file, double extortion (encryption plus data theft), a negotiation portal on Tor and a public leak blog the operators called the Happy Blog. Because the encryptor and affiliate playbooks outlived the core team, the brand can resurface without its founders, as WebLogic exploitation in 2026 showed.
An old patch gap revived Sodinokibi
Honeypots watching WebLogic ports 7001 and 7002 recorded scans and payloads from mid-May 2026 that delivered Cobalt Strike beacons, Cryptocurrency miners and Sodinokibi. The entry point was CVE-2024-21182, an unauthenticated flaw in WebLogic's T3 and IIOP channels that Oracle had already fixed. CISA added it to its known-exploited catalogue on 1 June with a federal deadline of 22 June.
A severity score of 7.5 out of 10 kept the flaw off most emergency patch lists, so it stayed open on financial-services and government servers. No public source has said whether this Sodinokibi activity comes from the original operators, copycats using leaked builder code, or former affiliates.
What is REvil ransomware and is it still active?
What was the Kaseya ransomware attack by REvil?
How was Sodinokibi/REvil disrupted in 2022?
Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Updated 12 October 2026. Editorial standards.