Close Menu

REVIL · Threat actor profile

THREAT ACTOR

REVIL_

Dormant

REvil, also known as Sodinokibi, was a high-profile ransomware-as-a-service operation linked to attacks on Kaseya, JBS Foods, and Travelex between 2019 and 2021. Russian authorities announced the arrest of several alleged members in early 2022, although successor branding briefly resurfaced afterwards.

For Ransomnews editorial coverage of REVIL, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.

41 Victims tracked
0 / 10 Active mirrors
2021-09-09 First listing
2022-11-29 Most recent

Victims by year

  • 2022 13
  • 2021 28

Leak site mirrors

10 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.

  • dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion 404 Not Found snapshot · 2022-08-19 14:15
  • aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion 404 Not Found snapshot · 2022-08-19 10:13
  • blogxxu75w63ujqarv476otld7cyjkq4yoswzt4ijadkjwvg3vrvd5yd.onion Blog snapshot · 2023-01-06 18:05
  • 2wub3njb7zvmnn6xohbuizjcbvy4w5dvlb4puesry3rrl6gx4452ezid.onion snapshot · 2024-12-10 15:25
  • 54xj22qsftuzs6bhcistgz27reblgijdjggkgb3fdhfgl3ghkmzk7dad.onion snapshot · 2024-12-10 15:25
  • 65x5syrn4gmgfnicrhyfwkokw5x3xipxer2z4vhhckrh756v6m5272qd.onion snapshot · 2024-12-10 15:25
  • fsgwyl2xd2h5s43er7epr6vuqu5eddmmtgp6cq7khmkoe3ba4d37w7ad.onion snapshot · 2024-12-10 15:26
  • rrjwr4jsju3nuwjz77hbcquiuq5hc3oc7yxlgi5rxeazehf7mlkzcvid.onion snapshot · 2024-12-10 15:26
  • ttn4gqpgvyy6tuezexxhwiukmm2t6zzawj6p3w3jprve36f43zxr24qd.onion snapshot · 2024-12-10 15:26
  • landxxeaf2hoyl2jvcwuazypt6imcsbmhb7kx3x33yhparvtmkatpaad.onion snapshot · 2024-12-10 22:39

Recent victims

The 50 most recent victims claimed by REVIL. Total in the index: 41.

Date listed Victim Description
2022-11-29 kusd.edu
2022-11-28 Sunknowledge Services Inc
2022-11-07 medibank.com.au
2022-09-01 Midea Group
2022-08-18 Asfaltproductienijmegen
2022-08-18 CYMZ
2022-08-18 Visotec Group www.visotec.com
2022-08-18 Stratford University
2022-08-18 www.oil-india.com
2022-08-18 Unicity International
2022-08-18 Ludwig Freytag Group
2022-08-18 Doosan Group
2022-08-18 OptiProERP is a leading global provider of industry-specific ERP solutions for manufacture
2021-10-15 PTT Exploration and Production - 720GB
2021-10-08 ECKERD PERU S.A, INKAFARMA, MIFARMA
2021-10-07 Join us on RAMP
2021-10-01 Ronmor Holdings
2021-09-30 Fimmick CRM Hong Kong (www.fimmick.com)
2021-09-30 Fimmick CRM Honk Kong (www.fimmick.com)
2021-09-16 Spiezle Architectural Group Inc.
2021-09-11 ohiograting.com
2021-09-09 Apex America
2021-09-09 Allen, Dyer, Doppelt, & Gilchrist, P.A.
2021-09-09 Betenbough Homes
2021-09-09 CEC Vibration Products
2021-09-09 ENPOL LLC
2021-09-09 Iaffaldano, Shaw & Young LLP
2021-09-09 angstrom automotive group
2021-09-09 Agile Property Holdings
2021-09-09 Möbelstadt Sommerlad
2021-09-09 Gosiger
2021-09-09 neroindustry.com
2021-09-09 kuk.de / KREBS + KIEFER / 500GB
2021-09-09 KASEYA ATTACK INFO
2021-09-09 Daylesford - BHoldings - Bamford - The Wild Rabbit
2021-09-09 Hx5, LLC
2021-09-09 inocean.no / 2000 GB
2021-09-09 Primo Water
2021-09-09 lstaff.com / atworksprofessional / atworks.com
2021-09-09 South Carolina Legal Services breach
2021-09-09 ensingerplastics.com

CONFIRMED ATTACKS

REvil confirmed attacks: 170 verified incidents

Ransomnews has verified 170 REvil incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from June 2019 to January 2023. United States accounts for 78 of them (46%), with victims recorded in 33 countries in total. The most affected sector is manufacturing, at 22 confirmed victims. A ransom payment was publicly confirmed in 10 cases and publicly refused in 27; the outcome is unrecorded in the remaining 133. Where a figure was disclosed (37 cases), these incidents account for 2,479,157 exposed records.

170Verified incidents
33Countries
2019–2023Active range
27%Paid, where outcome known

Confirmed victims by year

  • 201919
  • 202076
  • 202173
  • 20221
  • 20231

Most affected sectors

  • Manufacturing22
  • Healthcare20
  • Government18
  • Finance15
  • Technology14
  • Retail14
  • Service13
  • Other12

Most affected countries

  • United States78
  • United Kingdom17
  • Australia9
  • Canada7
  • Germany6
  • France6
  • Brazil5
  • Spain4

Verified REvil incidents (100 most recent of 170)

DateOrganisationSector LocationRecordsRansom paidSource
January 2023 Poznan University of Medical Sciences (Uniwersytet Medyczny im. Karola Marcinkowskiego w Poznaniu) Education Poznań, Poland — Unknown Source
May 2022 Ludwig Freytag Construction Oldenburg, Germany — Unknown Source
October 2021 Fimmick Service Hong Kong, Hong Kong — Unknown Source
September 2021 Ronmor Holdings Service Calgary, Canada — Unknown Source
September 2021 Ensinger Plastics Manufacturing Nufringen, Germany — Unknown Source
August 2021 Voip Unlimited Utilities Poole, United Kingdom — Unknown Source
July 2021 Hoppenbrouwers Techniek Technology Udenhout, Netherlands — No Source
July 2021 Kaseya Technology Florida, United States — Unknown Source
July 2021 Hx5, LLC Service Florida, United States — Unknown Source
July 2021 MasMovil Utilities Madrid, Spain — Unknown Source
July 2021 Inocean Utilities Oslo, Norway — Unknown Source
June 2021 University Medical Center of Southern Nevada Healthcare Nevada, United States 1,300,000 Unknown Source
June 2021 The Smith & Wollensky Restaurant Group, Inc. Food and Beverage Massachusetts, United States 1,189 Unknown Source
June 2021 Stevens & Lee Legal Pennsylvania, United States 23,066 Unknown Source
June 2021 Primo Water Food and Beverage Florida, United States — Unknown Source
June 2021 Vic Pharma Industry and Trade Ltd. Healthcare Taquaritinga, Brazil — Unknown Source
June 2021 Asfalt Productie Nijmegen Manufacturing Nijmegen, Netherlands — Unknown Source
June 2021 Trasporti Internazionali Transmec s.p.a. Transportation Campogalliano, Italy — Unknown Source
June 2021 Tendraide Food and Beverage Châteaubourg, France — Unknown Source
June 2021 Whittlesey & Hadley Finance Connecticut, United States — Unknown Source
June 2021 Nero Industry Manufacturing Sincan, Turkey — Unknown Source
June 2021 Istaff Service Georgia, United States — Unknown Source
June 2021 French Connection Holdings, Inc. Retail New York, United States 764 Unknown Source
June 2021 Grupo Fleury Healthcare São Paulo, Brazil — Unknown Source
June 2021 Fujifilm Manufacturing Minato City, Japan — No Source
June 2021 French Connection Retail London, United Kingdom — Unknown Source
June 2021 Daylesford/Bamford/The Wild Rabbit/BHoldings Retail Daylesford, United Kingdom — Unknown Source
June 2021 Citroen Wells Finance London, United Kingdom — Unknown Source
June 2021 Arnoff Moving & Storage Service New York, United States — Unknown Source
May 2021 Letko, Brosseau & Associates, Inc. Finance Montreal, Canada 20 Unknown Source
May 2021 Higashiosaka City Medical Center Healthcare Higashiosaka, Japan — Unknown Source
May 2021 Sol Oriens Service New Mexico, United States — Unknown Source
May 2021 Royal Resorts Other Cancún, Mexico — Unknown Source
May 2021 JBS USA Holdings Inc. Food and Beverage Colorado, United States — Yes Source
May 2021 Keyence Manufacturing Neu-Isenburg, Germany — Unknown Source
May 2021 Apex America Technology Cordoba, Argentina — Unknown Source
May 2021 Agile Property Holdings Construction Guangzhou, China — Unknown Source
May 2021 John Galon Insurance Services Ltd Finance Regina, Canada — Unknown Source
May 2021 Betenbough Homes Construction Texas, United States — Unknown Source
April 2021 UnitingCare Queensland Healthcare Brisbane, Australia — Yes Source
April 2021 Tribunal de Justiça do Estado do Rio Grande do Sul (TJRS) Government Porto Alegre, Brazil — Unknown Source
April 2021 Treehouse Hotels Other London, United Kingdom — Unknown Source
April 2021 Quanta Computer Inc. Manufacturing Taipei, Taiwan — Unknown Source
April 2021 Invenergy Utilities Illinois, United States 25,298 No Source
April 2021 Mipharm SPA Healthcare Milan, Italy — Unknown Source
April 2021 Habia Cable Manufacturing Norderstedt, Germany — Unknown Source
April 2021 Fiji Government Government Suva, Fiji — Unknown Source
April 2021 Amfine Chemical Corporation Manufacturing New Jersey, United States 597 No Source
March 2021 Pureform Diagnostic Imaging Clinics, Inc. Healthcare Calgary, Canada 1,139 Unknown Source
March 2021 Standley Systems Technology Oklahoma, United States — No Source
March 2021 South Carolina Legal Services Legal South Carolina, United States 409 Unknown Source
March 2021 Tata Steel Group Manufacturing Mumbai, India — No Source
March 2021 Lydall, Inc. Manufacturing Connecticut, United States 3,100 Unknown Source
March 2021 Pierre Fabre Healthcare Castres, France — Unknown Source
March 2021 MBA Group Service London, United Kingdom — Unknown Source
March 2021 Kajima Corporation Construction Tokyo, Japan — Unknown Source
March 2021 Harris Federation Education Croydon, United Kingdom — No Source
March 2021 Asteelflash Manufacturing Neuilly-Plaisance, France — Unknown Source
March 2021 Acer Manufacturing Taipei, Taiwan — Unknown Source
March 2021 Community Resources for Justice, Inc. Other Massachusetts, United States 794 Unknown Source
March 2021 Banco Inmobiliario Mexicano Finance Mexico City, Mexico — Unknown Source
February 2021 Pan-American Life Insurance Group, Inc. Finance Louisiana, United States 78,874 Unknown Source
February 2021 Southern Arkansas University Education Arkansas, United States — Unknown Source
February 2021 Resort Lifestyle Communities (RLC) Other Nebraska, United States 14,700 Unknown Source
February 2021 Trigano Manufacturing Paris, France — Unknown Source
February 2021 Honeywell International Inc. Manufacturing North Carolina, United States 3,567 Unknown Source
February 2021 Gyrodata Utilities Texas, United States 2,064 Unknown Source
February 2021 General Insulation Company, Inc Retail Massachusetts, United States 394 Unknown Source
February 2021 Union Bank of Nigeria Finance Lagos, Nigeria — Unknown Source
February 2021 D.M. BARONE SPA Healthcare Modica, Italy — Unknown Source
February 2021 Civinity Solutions Construction Riga, Latvia — Unknown Source
January 2021 Kahan, Kerensky & Capossela, LLP Legal Connecticut, United States 218 Unknown Source
January 2021 Dairy Farm Group Retail Hong Kong, Hong Kong — Unknown Source
January 2021 Communauto Other Montreal, Canada 9,950 Unknown Source
January 2021 Assistcare Home Health Services LLC dba Preferred Home Care of NY/Preferred Gold Healthcare New York, United States 92,283 Unknown Source
December 2020 The Hospital Group (Transform Hospital Group) Healthcare London, United Kingdom — Unknown Source
December 2020 HUBER+SUHNER Manufacturing Herisau, Switzerland — Unknown Source
December 2020 Ficosa Manufacturing Barcelona, Spain — Unknown Source
November 2020 New Jersey Dental Hygienist Association (NJDHA) Healthcare New Jersey, United States — Unknown Source
November 2020 Siplec Retail Ivry-sur-Seine, France — Unknown Source
November 2020 RMD Kwikform Construction Walsall, United Kingdom — Unknown Source
November 2020 Managed.com Technology Nebraska, United States — Unknown Source
November 2020 Kenneth Copeland Ministries Other Texas, United States — Unknown Source
November 2020 Independent Liquor Group (ILG) Retail Sydney, Australia — Unknown Source
November 2020 E & J Gallo Winery Food and Beverage California, United States 19,176 Unknown Source
November 2020 Flagship Group Construction Norwich, United Kingdom — Unknown Source
November 2020 Nexia Australia Finance Sydney, Australia — No Source
October 2020 Matson Transportation Hawaii, United States 25,000 Unknown Source
October 2020 Ghilotti Bros. Inc. Construction California, United States 2,660 Unknown Source
October 2020 Gaming Partners International Corporation Manufacturing Nevada, United States — Unknown Source
October 2020 Hanover Chamber of Crafts Other Hannover, Germany — Unknown Source
October 2020 Centro Tecnológico de Automoción de Galicia (CTAG) Other Pontevedra, Spain — Unknown Source
October 2020 Braskem Other São Paulo, Brazil — Unknown Source
October 2020 Ansa McAl Service Port of Spain, Trinidad and Tobago — Unknown Source
October 2020 Cardinal Logistics Management Corp Transportation North Carolina, United States 24,650 Unknown Source
October 2020 Beacon Health Solutions Healthcare Florida, United States 20,151 Unknown Source
September 2020 Haberdashers’ Monmouth Schools Education Monmouth, United Kingdom — No Source
September 2020 VARD Manufacturing Ålesund, Norway — Unknown Source
September 2020 Synsam Group AB Healthcare Stockholm, Sweden — Unknown Source
September 2020 Meinhardt Group International Holdings Ltd. Service Singapore, Singapore — Unknown Source

Ransomnews coverage of REvil

Claimed vs confirmed. The figures above the fold on this page come from REvil's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.

← Back to Ransomtracker

Statistics on this page are computed by Ransomnews from a live leak-site monitoring feed. Numbers update every ten minutes. Operator-written victim descriptions are truncated and shown in snippet form only. Source data: RansomLook (CC BY 4.0), aggregated and adapted by Ransomnews.