Revil
Revil is a Russia-attributed ransomware group with a financial motive, tracked by Brandefense. It targets 16 sectors, including Government and Technology, in 28 countries, including the United States and the United Kingdom. It uses 45 MITRE ATT&CK techniques and exploits 25 known CVEs.
- Sodinokibi
- Origin
- Russia
- Techniques
- 45
- Exploited CVEs
- 25
- First seen
- Nov 7, 2022
- Last seen
- Nov 7, 2022
- Record updated
Who They Target.
About Revil.
Sodinokibi ransomware group also known as REvil (Ransomware Evil) operates as a ransomware-as-a-service (RaaS) model. After the group compromised his victims, they would threaten to publish the victim's sensitive data on their darknet blog named 'Happy Blog', unless the ransom is paid. The ransomware malware code used by REvil is pretty similar to the ransomware code used by DarkSide - a different threat actor. REvil group claims to steal information after a successful attack on the supplier of the tech giant Apple and stole confidential schematics of their upcoming products.
Last updated Oct 1, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.