MITRE ATT&CKsoftware (malware)
S0496 REvil
- Domain
- enterprise, ics
- Platforms
- Windows
- Aliases
- Sodin, Sodinokibi
- Version
- 2.3
- Created
- 2020-08-04
Description
REvil is a ransomware family that has been linked to the GOLD SOUTHFIELD group and operated as ransomware-as-a-service (RaaS) since at least April 2019. REvil, which as been used against organizations in the manufacturing, transportation, and electric sectors, is highly configurable and shares code similarities with the GandCrab RaaS.
Related
Uses · MITRE ATT&CK (44)
- T1701.006 JavaScript sub-technique
- T1701.001 PowerShell sub-technique
- T1685 Disable or Modify Tools technique
- T1688 Safe Mode Boot technique
- T1680 Local Storage Discovery technique
- T1480.002 Mutual Exclusion sub-technique
- T1027.013 Encrypted/Encoded File sub-technique
- T1027.011 Fileless Storage sub-technique
- T1614.001 System Language Discovery sub-technique
- T0886 Remote Services technique
- T0828 Loss of Productivity and Revenue technique
- T0849 Masquerading technique
- T0863 User Execution technique
- T0869 Standard Application Layer Protocol technique
- T0881 Service Stop technique
- T0882 Theft of Operational Information technique
- T1573.002 Asymmetric Cryptography sub-technique
- T1071.001 Web Protocols sub-technique
- T1204.002 Malicious File sub-technique
- T1059.001 PowerShell sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1059.005 Visual Basic sub-technique
- T1566.001 Spearphishing Attachment sub-technique
- T1069.002 Domain Groups sub-technique
- T1134.001 Token Impersonation/Theft sub-technique
- T1134.002 Create Process with Token sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1070.004 File Deletion sub-technique
- T1490 Inhibit System Recovery technique
- T1489 Service Stop technique
References
- https://blog.talosintelligence.com/2019/04/sodinokibi-ransomware-exploits-weblogic.html Talos Sodinokibi April 2019
- https://www.secureworks.com/research/revil-sodinokibi-ransomware Secureworks REvil September 2019
- https://threatvector.cylance.com/en_us/home/threat-spotlight-sodinokibi-ransomware.html Cylance Sodinokibi July 2019
- https://www.group-ib.com/whitepapers/ransomware-uncovered.html Group IB Ransomware May 2020
- https://www.gdatasoftware.com/blog/2019/06/31724-strange-bits-sodinokibi-spam-cinarat-and-fake-g-data G Data Sodinokibi June 2019
- https://intel471.com/blog/revil-ransomware-as-a-service-an-analysis-of-a-ransomware-affiliate-operation/ Intel 471 REvil March 2020
- https://securelist.com/sodin-ransomware/91473/ Kaspersky Sodin July 2019
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/ McAfee Sodinokibi October 2019
- https://www.picussecurity.com/blog/a-brief-history-and-further-technical-analysis-of-sodinokibi-ransomware Picus Sodinokibi January 2020
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-crescendo/ McAfee REvil October 2019
- https://www.secureworks.com/blog/revil-the-gandcrab-connection Secureworks GandCrab and REvil September 2019
- https://web.archive.org/web/20210414101816/https://tetradefense.com/incident-response-services/cause-and-effect-sodinokibi-ransomware-analysis/ Tetra Defense Sodinokibi March 2020