MITRE ATT&CK G0115

REvil / Sodinokibi

View MITRE Group Page ↗

Aliases: Sodinokibi, Gold Southfield

Official Attribution Source: U.S. Department of Justice (N.D. Tex.) & Europol Operation GoldDust

Key Facts

Jurisdiction

Russian Federation

Geographic origin

Cases

Prosecution matters

Defendants

Indicted individuals

Sanctions

OFAC designations

Attributed Country: Russian Federation.
ATT&CK Group Reference: G0115 (REvil / Sodinokibi).
Linked to 4 primary court prosecution record(s) with $131.0 million documented loss.
Identified 2 individually charged operative(s) and 0 OFAC designation(s).

Primary ATT&CK Techniques Employed

Technique frequencies extracted from verified indictments for REvil / Sodinokibi.

ATT&CK Techniques Mapped to REvil / Sodinokibi
Technique	Frequency
T1190 Exploit Public-Facing Application	1 incidents
T1574.002 DLL Side-Loading	1 incidents
T1486 Data Encrypted for Impact	1 incidents
T1569.002 Service Execution	1 incidents
T1082 System Information Discovery	1 incidents
T1078 Valid Accounts	1 incidents
T1567 Exfiltration Over Web Service	1 incidents

Prosecution Cases Attributed to REvil / Sodinokibi

U.S. v. Yaroslav Vasinskyi (Kaseya VSA / REvil Ransomware)

sentenced 2021-08-11

Ukrainian national and REvil ransomware affiliate responsible for deploying the ransomware attack that hijacked Kaseya VSA management software, instantly encrypting up to 1,500 downstream businesses on July 4th weekend.

Primary Attack Mechanism: Adversary initial penetration targeted internet-facing infrastructure by weaponizing known security vulnerabilities (CVE-2021-30116, CVE-2021-30117, CVE-2021-30118), subsequently leveraging administrative tooling to compromise victim Managed Service Providers, Information Technology, Retail, Education systems.

5 techniques mapped · Loss: $70.0 million View full case dossier →

U.S. v. Aleksandr Sikerin & Yevgeniy Polyanin (REvil Operations)

fugitive 2021-11-08

International enforcement action against REvil ransomware money exchangers and operators, recovering $6.1 million in ransomware proceeds extorted from businesses and local governments across the United States.

Primary Attack Mechanism: Initial access established against Local Government, Healthcare, Manufacturing infrastructure via compromised credentials, unmonitored perimeter services, or targeted spearphishing lures. International enforcement action against REvil ransomware money exchangers and operators, recovering $6.1 million in ransomware proceeds extorted from businesses and local governments across the United States.

1 techniques mapped · Loss: $13.0 million View full case dossier →

International Sanctions on Aleksandr Ermakov (Medibank Breach)

fugitive 2024-01-23

First joint cyber sanctions package deployed cooperatively by Australia, the United States, and the United Kingdom against Russian national Aleksandr Ermakov for orchestrating the catastrophic 2022 Medibank Private breach, stealing and weaponizing medical files of 9.7 million patients on dark web leak channels after extortion was refused.

Primary Attack Mechanism: Initial access established against Healthcare & Private Health Insurance infrastructure via compromised credentials, unmonitored perimeter services, or targeted spearphishing lures. First joint cyber sanctions package deployed cooperatively by Australia, the United States, and the United Kingdom against Russian national Aleksandr Ermakov for orchestrating the catastrophic 2022 Medibank Private breach, stealing and weaponizing medical files of 9.7 million patients on dark web leak channels after extortion was refused.

2 techniques mapped · Loss: $45.0 million View full case dossier →

SEC v. Blackbaud, Inc. (Misleading Ransomware Disclosure)

settled 2023-03-09

Landmark Securities and Exchange Commission enforcement order against public cloud software provider Blackbaud for making materially misleading disclosures concerning a May 2020 ransomware incident, omitting that attacker had exfiltrated unencrypted donor bank account and social security information while asserting sensitive data was not compromised.

Primary Attack Mechanism: Initial access established against Cloud Software & Non-Profit Technology infrastructure via compromised credentials, unmonitored perimeter services, or targeted spearphishing lures. Landmark Securities and Exchange Commission enforcement order against public cloud software provider Blackbaud for making materially misleading disclosures concerning a May 2020 ransomware incident, omitting that attacker had exfiltrated unencrypted donor bank account and social security information while asserting sensitive data was not compromised.

2 techniques mapped · Loss: $3.0 million View full case dossier →

Indicted Operatives & Dispositions (2)

Yevgeniy Polyanin fugitive

REvil affiliate indicted in N.D. Tex.; $6.1 million in ransom proceeds recovered by DOJ.

Sentence: Pending / None · Restitution: $6.1 million

Yaroslav Vasinskyi sentenced

REvil ransomware affiliate who carried out the Kaseya VSA attack. Sentenced to over 13 years in federal prison.

Sentence: 13 years (156 months)

Documented TTP Signature for REvil / Sodinokibi

Test Controls in Stack Audit →

T1190: Exploit Public-Facing Application

Adversaries exploit vulnerabilities in internet-connected software such as web servers or VPN appliances.

T1574.002: DLL Side-Loading

Adversaries execute malicious dynamic-link libraries by placing them alongside signed, legitimate executables.

T1486: Data Encrypted for Impact

Adversaries encrypt victim files and databases to disrupt business operations and demand financial extortion.

T1569.002: Service Execution

Adversaries create and run Windows services to execute payloads with system privileges.

T1082: System Information Discovery

Adversaries gather details about the operating system and architecture to guide further exploitation.

T1078: Valid Accounts

Adversaries obtain and misuse legitimate credentials of existing user accounts to maintain persistence and bypass controls.