Introduction
REvil is one of the most notorious ransomware groups of recent years. Formed in 2019, the group has attacked businesses, organizations, and governments worldwide and built its reputation on a string of high-profile ransomware campaigns.
Also known as Sodinokibi, REvil rose to prominence through attacks on healthcare, education, and manufacturing companies. The group runs a ransomware-as-a-service (RaaS) operation: affiliates carry out the intrusions while REvil supplies the malware and takes a cut of the ransom. That model, combined with heavily encrypted communications, has helped them stay ahead of law enforcement.
The playbook is familiar: break into a target’s systems, encrypt sensitive data, and demand a ransom for the decryption keys. REvil also popularized “double extortion,” where they threaten to leak the stolen data on top of holding it hostage, which puts extra pressure on victims to pay.
Their most notable attack came in 2021, when they targeted Kaseya, an IT management software provider. Compromising a single vendor let them encrypt data at over 1,000 businesses and organizations across the globe. REvil demanded $70 million in Bitcoin for a universal decryption key.
International efforts to dismantle REvil have had mixed results. The group vanished in October 2021, then re-emerged months later with new attacks and ransom demands.
Groups like REvil adapt quickly, and the threat they pose is far from over. The best protection is still the unglamorous work: patch your systems, keep offline backups, monitor your network, and train people to spot phishing. The cat-and-mouse game between law enforcement and ransomware crews will keep going for a long time.