The Demon REvil, the Franchised Blackmailer

Legend

Born in 2019 as the likely heir of GandCrab, it rented its ransomware to affiliates and embraced double extortion at scale: encrypt, then threaten to publish. In July 2021, through Kaseya VSA, it hit up to 1,500 businesses in one go. It was hit in late 2021 by Operation GoldDust, which led to affiliate arrests.

Exorcism

Cast it out by watching the supply chain: vendors' remote-management tools are front doors. Patch exposed products fast and keep backups an attacker cannot delete.

Technical record

Also known as: Sodinokibi, Sodin
Circle: Circle III · Ransomware and extortion
First seen: 2019
Status: Exorcised (Operation GoldDust, 2021-11-08)
Works: The Scourge of Kaseya · The Miracle of the Universal Key

A ransomware-as-a-service operation run by GOLD SOUTHFIELD that emerged in 2019 as the likely successor of GandCrab and embraced double extortion at scale. Its July 2021 attack via Kaseya VSA hit up to 1,500 businesses. Affiliates were arrested in Romania and elsewhere in Europol's Operation GoldDust in November 2021, and Russia's FSB detained members in January 2022.

Sources: attack.mitre.org · attack.mitre.org · europol.europa.eu · justice.gov · MITRE ATT&CK reference S0496