Revil

Sodinokibi ransomware group also known as REvil (Ransomware Evil) operates as a ransomware-as-a-service (RaaS) model. After the group compromised his victims, they would threaten to publish the victim's sensitive data on their darknet blog named 'Happy Blog', unless the ransom is paid. The ransomware malware code used by REvil is pretty similar to the ransomware code used by DarkSide - a different threat actor. REvil group claims to steal information after a successful attack on the supplier of the tech giant Apple and stole confidential schematics of their upcoming products.

Victims

First Discovered

2019-08-26

victim

Last Discovered

2022-11-28

victim

Inactive Since

3yrs

more than

Avg Delay

N/A

attack→claim

Infostealer

100.0%

victims with domain

View Victims on World Map

View group statistics

Known Locations (3)

Title	Available	Last Visit	FQDN
404 Not Found	No	2025-06-01 21:18:36	`dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion`
404 Not Found	No	2025-06-01 21:19:06	`aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion`
Blog	No	2025-06-01 21:19:14	`blogxxu75w63ujqarv476otld7cyjkq4yoswzt4ijadkjwvg3vrvd5yd.onion`

This information is provided by Ransomware-Tool-Matrix
Discovery	RMM Tools	Defense Evasion	Credential Theft	OffSec	Networking	LOLBAS	Exfiltration
AdFind Bloodhound placeholder	placeholder placeholder placeholder	placeholder placeholder placeholder	placeholder placeholder placeholder	Cobalt Strike placeholder placeholder	placeholder placeholder placeholder	BITSAdmin placeholder placeholder	PrivatLab RClone Sendspace

Revil

Known Locations (3)

Target (Available)

Heatmap (Available)

Ransom Notes (3)

Tools Used (Available)

Vulnerabilities Exploited (0)

TTPs Matrix (0)

Negotiation Chats (20)

YARA Rules (0)

Indicators of Compromise (IoCs) (0)

Victims (98)