REvil/Sodinokibi, also known as Sodin, is a sophisticated ransomware discovered in April 2019. This elusive malware encrypts files and cleverly erases its ransom request message, leaving victims unaware. Once encryption is complete, victims receive a Bitcoin ransom demand.
This ransomware evades traditional security measures, infiltrating systems undetected, appealing to cybercriminals due to its stealthy nature. It’s an example of Ransomware-as-a-Service, with code authors and affiliates working together. This model heightens its danger, enabling large-scale attacks with minimal risk.
REvil is linked to the GandCrab ransomware’s authors, who share connections. Globally, it targets organizations and individuals, concentrating on countries like Mexico, the U.S., Japan, and Germany. Notable attacks include JBS Foods, Kaseya, Travelex, and Acer, causing significant disruptions and financial losses.
REvil employs various attack methods, including RDP assaults, software flaws, and phishing. After infiltration, files and backups are encrypted. Sodinokibi ransomware can encrypt data using curve25519/Salsa20 and keys using curve25519/AES-256-CTR. The user’s private key is encrypted by the malware using two public keys. Additionally, this infection uses asymmetric key scheduling and command and control server obfuscation, which enable the malware to function without a connection to the C2.
In summary, REvil/Sodinokibi is a sophisticated ransomware with elusive behavior. It demands Bitcoin ransoms, exploits weaknesses, and poses a significant threat to organizations globally.
The ransom note placed by REvil (Source: Elliptic)