REvil, also called Sodinokibi, turned a single flaw in a managed service provider tool into ransomware on endpoints across Kaseya's customer base on one day in July 2021. It was one of the most prolific ransomware-as-a-service operations of 2019 to 2021, and its trajectory, from GandCrab code lineage through the Kaseya supply chain attack to international arrests and sanctions, explains a lot about how ransomware works today. This profile covers what REvil was, how its affiliates operated, why the Kaseya incident changed how organisations treat their IT providers, and what defenders should still check. It is written for security operations, threat intelligence and third-party risk teams. For how REvil fits among related brands, see the Ransomware Family Lineage and Rebrands Guide.
Key takeaways
- A RaaS with a GandCrab lineage. MITRE ATT&CK records REvil (S0496) as operating since at least April 2019, sharing code similarities with GandCrab, and linked to the GOLD SOUTHFIELD group (G0115).
- Trusted tools were the delivery channel. The 2 July 2021 Kaseya attack exploited on-premises Kaseya VSA, a remote monitoring and management (RMM) platform, to push REvil to customer endpoints.
- Data theft came early. ATT&CK notes GOLD SOUTHFIELD added theft and leak threats by early 2020, making REvil an early double extortion operator.
- Law enforcement hit it from several directions. Europol reported five affiliate arrests between February and November 2021, DOJ seized US$6.1 million traceable to ransom payments, and the US Treasury sanctioned operators and a laundering exchange.
- The lesson is about suppliers. An RMM agent runs with high privilege on every managed machine, so MSP access needs the same control as your own admin accounts.
What it is
REvil was ransomware-as-a-service: a core group maintained the encryptor, payment portal and leak site, and recruited affiliates to break in and deploy it for a share of each ransom. ATT&CK describes GOLD SOUTHFIELD as supplying backend infrastructure to affiliates recruited on underground forums for high value deployments. The business model is covered in the Ransomware-as-a-Service Business Model Guide.
| Attribute | Detail | Source |
|---|---|---|
| Names | REvil, Sodinokibi, Sodin | MITRE ATT&CK S0496 |
| Operator group | GOLD SOUTHFIELD (alias Pinchy Spider) | MITRE ATT&CK G0115 |
| Active from | At least April 2019 | MITRE ATT&CK S0496 |
| Lineage | Code similarities with GandCrab RaaS | MITRE ATT&CK S0496; Europol |
| Scale | About 7,000 infections and more than EUR 200 million demanded | Europol, November 2021 |
| Payments | More than US$200 million in Bitcoin and Monero | US Treasury, November 2021 |
| Sectors noted | Manufacturing, transportation, electric | MITRE ATT&CK S0496 |
| Signature incident | Kaseya VSA supply chain attack, 2 July 2021 | US DOJ; CISA |
How it works
REvil affiliates used several entry routes, then a common sequence on the host. The table maps documented behaviour to ATT&CK v20 techniques and the control that most directly disrupts each.
| Stage | Behaviour | ATT&CK v20 | Disrupting control |
|---|---|---|---|
| Initial access | Compromise of software or tools that suppliers push to customers | T1195.002 Compromise Software Supply Chain; T1199 Trusted Relationship | Supplier access review, RMM hardening, segmentation of MSP connections |
| Initial access | Exploitation of internet-facing applications | T1190 Exploit Public-Facing Application | Patch edge and RMM servers to KEV timelines; remove unneeded exposure |
| Initial access | Remote services and phishing | T1133 External Remote Services; T1566 Phishing; T1189 Drive-by Compromise | Phishing-resistant MFA; attachment and web filtering |
| Execution | PowerShell, command shell, VBScript and WMI | T1059.001, T1059.003, T1059.005, T1047 | Script block logging; restrict scripting for standard users |
| Privilege | Token theft and process creation with stolen tokens | T1134.001, T1134.002 | Credential Guard, tiered admin, limit admin sessions on workstations |
| Discovery | Checks system language before running | T1614.001 System Language Discovery | Detection value only: record it as a behaviour indicator |
| Defence impairment | Disables security tools; reboots into Safe Mode to run where tools may not load | T1685 Disable or Modify Tools; T1688 Safe Mode Boot | Endpoint tamper protection; alert on bcdedit safe boot changes |
| Impact | Stops services, deletes shadow copies, encrypts files | T1489 Service Stop; T1490 Inhibit System Recovery; T1486 | Immutable, offline backups with tested restores |
| Exfiltration | Data sent over the command channel | T1041 Exfiltration Over C2 Channel | Egress monitoring for unusual volume from servers |
The Kaseya VSA attack
According to CISA, CISA and the FBI began responding on 2 July 2021 to ransomware attacks against MSPs and their downstream customers. Kaseya shut down its SaaS servers as a precaution and told on-premises VSA customers to shut theirs down, because the attackers had exploited a vulnerability in the on-premises product. Kaseya began restoring SaaS and released an on-premises patch on 11 July 2021. DOJ states the attack deployed REvil to endpoints on Kaseya customer networks, affecting organisations around the world.
The Dutch Institute for Vulnerability Disclosure (DIVD) had reported seven VSA vulnerabilities to Kaseya on 6 April 2021, and says one of the two used in the attack was among them. CVE-2021-30116, a VSA credential leak and business logic flaw, is in the CISA KEV catalogue with known ransomware use. The pattern matters: a disclosed but not yet fully fixed flaw in an internet-facing management server is a race, and attackers sometimes win it.
Because RMM agents run with high privilege on every managed endpoint, one compromised server became a distribution system. The defensive response is covered in the Compromised MSP Playbook and the RMM Tool Security Guide.
Disruption and enforcement
- Arrests: Europol reported that Romanian authorities arrested two affiliates on 4 November 2021, bringing affiliate arrests since February 2021 to five, alongside two GandCrab-linked suspects.
- Charges and seizure: On 8 November 2021 DOJ announced charges over the Kaseya attack, an arrest in Poland pending extradition and the seizure of US$6.1 million traceable to ransom payments, with help from Ukraine and other partners.
- Sanctions: The same day the US Treasury sanctioned REvil operators and the Chatex virtual currency exchange for laundering proceeds. Sanctions affect payment decisions: see the Ransomware Payments and Sanctions Guide.
Why it matters
REvil is inactive as a brand, but three of its lessons are current.
- Supplier privilege is your privilege: The Kaseya attack showed that an MSP's management plane is effectively a domain admin on every customer. CISA's guidance asked customers to keep MSP accounts out of administrator groups, limit them to the systems they manage, disable them when not in use, and route MSP traffic through a dedicated VPN.
- Exposure windows on management servers: Internet-facing RMM, file transfer and remote access servers attract exploitation, and a vulnerability disclosed privately can still be found and used by others before the fix lands.
- Enforcement works but is slow: Arrests, seizure and sanctions came months after peak activity. Defence cannot wait for takedowns.
Detection and measurement
| Signal | Where to look | Why it matters |
|---|---|---|
| RMM agent spawning PowerShell or cmd that disables security tools | EDR parent and child process telemetry | The Kaseya delivery pattern: trusted agent, untrusted action |
| bcdedit setting safe boot | Process creation (Security Event ID 4688, Sysmon Event ID 1) | REvil's Safe Mode Boot technique (T1688) |
| Shadow copy deletion and mass service stops | Process creation, System log service control events | Immediate pre-encryption activity |
| New services or scheduled tasks pushed fleet wide outside a change window | Security Event ID 4697, System Event ID 7045, RMM job logs | Mass deployment through management tools |
| Security log cleared | Security Event ID 1102 | Covering tracks on servers |
Useful measures: percentage of MSP and RMM accounts with phishing-resistant MFA and least privilege (target 100 percent); number of supplier accounts with standing domain admin rights (target zero); days to patch internet-facing management servers after a KEV listing; percentage of RMM job executions matched to an approved change; and restore test success rate for critical systems.
Framework mapping
| Framework | Reference | REvil relevance |
|---|---|---|
| NIST CSF 2.0 | GV.SC-05, GV.SC-07, PR.PS-02, PR.DS-11, RS.MI-01 | Supplier contract requirements and monitoring, software maintenance, backups, containment |
| NIST SP 800-53 Rev. 5 | SA-9, SR-3, AC-6, CP-9, SI-4 | External system services, supply chain controls, least privilege, backup, monitoring |
| MITRE ATT&CK v20 | T1195.002, T1199, T1190, T1688, T1685, T1490, T1486 | Supply chain and trusted relationship entry, Safe Mode boot, recovery inhibition, encryption |
Common misconceptions
- "Supply chain attacks only come through software updates." Kaseya was an exploited management server, not a poisoned update. Any tool that can run commands on your fleet is part of your supply chain.
- "Our MSP handles security, so their access is safe." CISA's guidance put specific obligations on customers: monitor connections to MSP infrastructure, restrict MSP accounts and write notification duties into contracts.
- "REvil disappeared, so its affiliates did too." Arrests covered a handful of people; affiliates move between RaaS brands. The Ransomware Groups Guide tracks current operators.
- "Safe Mode is a recovery tool, not a threat." REvil used a Safe Mode reboot to evade tools that do not load there. Treat unexpected safe boot changes as high severity.
- "Paying ends it." REvil operators and the exchange that laundered their money were sanctioned. Payments can create legal exposure as well as funding further attacks.
Related concepts
REvil connects to several wider topics. Its use of a trusted provider links to third-party risk; see the Managed Service Provider Risk Assessment Guide and the Top 10 Supply Chain Attacks. Its leak site belongs with the Ransomware Leak Sites and Victim Shaming Guide.
Identity sits at the centre of the Kaseya lesson. RMM agents, MSP technician accounts and the service accounts that run management servers are non-human or third-party identities with fleet-wide privilege. Inventory them, give them the minimum scope, require MFA where a person logs in, and review them as you would your own privileged accounts. The GDAP and MSP Delegated Admin Access Guide covers this for Microsoft 365 tenants.
Applying the lessons
- Inventory: List every supplier and tool able to run code on your endpoints or servers (RMM, EDR consoles, patch tools, remote support) and who holds their admin accounts.
- Reduce: Remove standing domain admin from supplier accounts, scope agents to the systems they manage and require phishing-resistant MFA on management consoles.
- Isolate: Keep on-premises management servers off the internet or behind a VPN or zero trust gateway; route MSP traffic through a dedicated path.
- Detect: Deploy the alerts above in audit mode for two weeks, tune out approved RMM jobs, then enforce. Keep a rollback, such as disabling a single rule, documented.
- Rehearse: Run a tabletop where your MSP's console is the attacker's tool, including how you would cut that connection quickly.
Small organisations that rely entirely on one MSP should focus on contract terms, MFA, backups the MSP cannot delete and a way to cut the MSP's access. Larger organisations should add RMM job approval workflows and behavioural detection on agent activity.
Practitioner checklist
- Inventory every tool and supplier that can execute code across your estate, with named owners.
- Remove standing administrator rights from MSP accounts and disable them when not in use.
- Require phishing-resistant MFA on RMM and remote support consoles.
- Keep on-premises management servers off the public internet and patch them to KEV timelines.
- Alert on RMM agents launching scripts that disable security tools or delete shadow copies.
- Alert on bcdedit safe boot changes and Security Event ID 1102.
- Keep immutable backups that neither your admins nor your MSP can delete, and test restores.
- Write security controls, monitoring and incident notification duties into MSP contracts.
- Check sanctions exposure with legal counsel before any ransom decision.
Standards and references
- CISA: Kaseya Ransomware Attack: Guidance for Affected MSPs and their Customers
- US Department of Justice: Arrest and charges in the Kaseya ransomware attack
- US Treasury: Sanctions on REvil ransomware operators and the Chatex exchange
- Europol: Five affiliates to Sodinokibi/REvil unplugged
- MITRE ATT&CK: REvil (S0496)
- MITRE ATT&CK: GOLD SOUTHFIELD (G0115)
- DIVD CSIRT: Kaseya VSA limited disclosure
- CISA: Known Exploited Vulnerabilities Catalog
Related NHI Mgmt Group resources: Ransomware Family Lineage and Rebrands Guide · Compromised MSP Playbook · RMM Tool Security Guide · Ransomware Prevention Guide