- Category
- Criminal · Financially motivated: ransomware, fraud and theft.
- Origin
- Russia(medium confidence)
- Seen
- 2019–2021
- Status
- Dormant
- Sources
- 2 sources carry it
- Identifier
- GINC-APT-1143 · revil
RussiaWhat it is
REvil is a Russian ransomware-as-a-service operation that has targeted major corporations worldwide.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Other names
- GrandCrab, Sodin, Sodinokibi, Water Mare
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Targets
- Sectors
- Healthcare, Legal, Technology
Tools
The tools and malware families the sources tie to it.
- FileZilla
- IcedID
- PsExec
- Qakbot
- Sodinokibi