S0496Windows
S0496REvil
Platforms
1
ATT&CK
14.1
References
13
Description
[REvil](https://attack.mitre.org/software/S0496) is a ransomware family that has been linked to the [GOLD SOUTHFIELD](https://attack.mitre.org/groups/G0115) group and operated as ransomware-as-a-service (RaaS) since at least April 2019. [REvil](https://attack.mitre.org/software/S0496), which as been used against organizations in the manufacturing, transportation, and electric sectors, is highly configurable and shares code similarities with the GandCrab RaaS.(Citation: Secureworks REvil September 2019)(Citation: Intel 471 REvil March 2020)(Citation: Group IB Ransomware May 2020)
Platforms· 1
Windows
Attributed to1
| Type | Target | Confidence | Tier |
|---|---|---|---|
| Group | GOLD SOUTHFIELDg0115 | 100% | live |
References
- https://attack.mitre.org/software/S0496
- https://blog.talosintelligence.com/2019/04/sodinokibi-ransomware-exploits-weblogic.html
- https://www.secureworks.com/research/revil-sodinokibi-ransomware
- https://threatvector.cylance.com/en_us/home/threat-spotlight-sodinokibi-ransomware.html
- https://www.group-ib.com/whitepapers/ransomware-uncovered.html
- https://www.gdatasoftware.com/blog/2019/06/31724-strange-bits-sodinokibi-spam-cinarat-and-fake-g-data
- https://intel471.com/blog/revil-ransomware-as-a-service-an-analysis-of-a-ransomware-affiliate-operation/
- https://securelist.com/sodin-ransomware/91473/
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/
- https://www.picussecurity.com/blog/a-brief-history-and-further-technical-analysis-of-sodinokibi-ransomware
Related by meaning· 6
Nearest entities by semantic similarity across the cs-graph corpus.