Ransomware.live: revil

Sodinokibi ransomware group also known as REvil (Ransomware Evil) operates as a ransomware-as-a-service (RaaS) model. After the group compromised his victims, they would threaten to publish the victim's sensitive data on their darknet blog named 'Happy Blog', unless the ransom is paid. The ransomware malware code used by REvil is pretty similar to the ransomware code used by DarkSide - a different threat actor. REvil group claims to steal information after a successful attack on the supplier of the tech giant Apple and stole confidential schematics of their upcoming products.

Victims

First Discovered

2019-08-26

victim

Last Discovered

2022-11-28

victim

Inactive Since

3yrs

more than

Avg Delay

N/A

attack→claim

Infostealer

66.7%

victims with domain

Countries

hit

View Victims on World Map View Group Statistics

Known Locations (3)

Title	Available	Last Visit	FQDN
404 Not Found	No	2026-04-28T07:26:13	`dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion`
404 Not Found	No	2026-04-28T07:28:46	`aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion`
Blog	No	2026-04-28T07:31:13	`blogxxu75w63ujqarv476otld7cyjkq4yoswzt4ijadkjwvg3vrvd5yd.onion`

This information is provided by Ransomware-Tool-Matrix
Discovery	RMM Tools	Defense Evasion	Credential Theft	OffSec	Networking	LOLBAS	Exfiltration
AdFind Bloodhound placeholder	placeholder placeholder placeholder	placeholder placeholder placeholder	placeholder placeholder placeholder	Cobalt Strike placeholder placeholder	placeholder placeholder placeholder	BITSAdmin placeholder placeholder	PrivatLab RClone Sendspace

TTPs Matrix (9)

This information is provided by Crocodyli & Ransomware.live
Initial Access	Execution	Defense Evasion	Credential Access	Discovery	Lateral Movement	Exfiltration	Command and Control	Impact
Valid Accounts	Command and Scripting Interpreter: PowerShell	Obfuscated Files or Information	OS Credential Dumping: LSASS Memory	System Information Discovery	Remote Services: Remote Desktop Protocol	Exfiltration Over Web Service: Exfiltration to Cloud Storage	Application Layer Protocol: Web Protocols	Data Encrypted for Impact
Exploit Public-Facing Application	Signed Binary Proxy Execution: Msiexec	Virtualization/Sandbox Evasion		Network Share Discovery				Inhibit System Recovery
Supply Chain Compromise		Disable or Modify Tools

Revil

Known Locations (3)

Target

Heatmap

Ransom Notes (3)

Tools Used

TTPs Matrix (9)

Negotiation Chats (20)

YARA Rules (1)

Victims (96)