Which threat actors have used Sodinokibi (REvil) Ransomware?

Who Used Sodinokibi, and What Kind of Threat Model Was It?

Sodinokibi, also known as REvil, was used by a ransomware operation run by financially motivated actors rather than a broad set of unrelated groups. That matters because the behaviour is best understood as an organised extortion campaign: access brokers, initial compromise, and payment pressure, not a random or one-off malware event.

The key practical point is that attribution at the actor-group level usually tells you more about operating style than about a single fixed “threat actor name” to block. For defenders, the recurring pattern is initial access, stealthy staging, data theft, and then encryption or extortion leverage.

For a broader view of how ransomware crews structure access, extortion, and reuse of techniques across campaigns, the Ransomware Groups Guide is useful context. It helps separate the criminal ecosystem from the specific malware family, which is important when the same ransomware is operated through affiliates, brokers, or rebranded crews.

How Should Defenders Interpret REvil Activity?

REvil activity should be interpreted as an extortion playbook with a strong operational component. The malware is only the last stage of the campaign. The more important signals are exposed services, brokered access, privilege escalation, lateral movement, and evidence of files or archives being staged before encryption.

That means defenders should not wait for visible encryption before treating the incident as serious. By the time encryption starts, the adversary may already have harvested credentials, moved through privileged systems, or exfiltrated data needed for double extortion.

Campaign-level threat reporting is especially useful here because it shows how criminal groups reuse initial access methods, credential theft, and exfiltration workflows across many victims. The CISA cyber threat advisories and the ENISA Threat Landscape are both good references for tracking that broader pattern rather than treating each ransomware family as an isolated case.

For a deeper threat-actor framing, the Threat Actor Groups Guide is the better internal starting point when you need to map aliases, naming conventions, and the difference between a malware family and an operating group.

What Security Signals Matter Most When REvil-Style Ransomware Is in Play?

The most useful detection signals are not just file encryption events. Look for unusual remote access, new administrative tooling, abnormal archive creation, bulk file discovery, large outbound transfers, and account activity that does not fit normal privilege use. Those signals often appear before the payload executes.

Backup exposure is another major decision point. If backups are online, reachable from production, or managed from the same identity plane as the rest of the environment, ransomware operators can disable recovery just as effectively as they encrypt primary systems. Separation, immutability, and restore testing matter because the attacker’s goal is to remove your options, not just your data.

Identity and credential abuse are often the enabling layer, even when the headline is ransomware. When the intrusion starts with stolen or brokered access, the real question is whether the attacker can reuse that access long enough to stage data and reach high-value systems. That is why service hardening and identity monitoring are part of the ransomware response, not a separate concern.

The State of NHI & AI Agent Breach Report 2026 is not ransomware-specific, but it is relevant to the access pattern: it shows how stolen tokens, compromised service accounts, and exposed secrets create fast paths from initial access to later-stage abuse.

Risk and Threat Considerations

REvil-style ransomware is high-risk because the attack model combines access brokerage, privilege abuse, data theft, and encryption into one operational chain. The consequence is often broader than downtime, since the same access can expose backups, sensitive data, and administrative pathways needed for recovery.

Failure mechanism: An attacker gets in through an exposed service, weakly governed account, or brokered access, then uses privileged reach to stage data, disable recovery, and deploy encryption after the environment is already under control.

Impact: Organisations can lose both operational availability and confidence in the integrity of their data. If exfiltration occurred first, they may also face extortion pressure even after restoration.

Practitioner Guidance

What to prioritise: Treat exposed remote services, privileged access paths, and backup reachability as the first containment questions. If those three are not under control, you do not yet have a complete ransomware defence.

What to verify: Confirm whether the intrusion chain included brokered access, stolen credentials, or signs of staging before encryption. That determines whether the response should stay at malware removal or expand to credential rotation, session invalidation, and lateral-movement review.

What good looks like: Backups are isolated enough that production compromise does not automatically imply backup compromise, and identity monitoring can distinguish normal administrative activity from attacker reuse of valid access.

Practitioner takeaway: With REvil-style operations, the decisive issue is not the brand of ransomware but the attacker’s access and preparation time, because that is what determines whether recovery is a restoration exercise or a full compromise investigation.

Related resources from NHI Mgmt Group

• Which threat actors have used Locky Ransomware?
• Which threat actors have used RansomEXX Ransomware?
• Which threat actors have used DoppelPaymer Ransomware?
• What does AI model abuse reveal about the current NHI threat surface?