← All ransomware groups

Ransomware group profile · #71 by claimed victims

Revil ransomware

Sodinokibi ransomware group also known as REvil (Ransomware Evil) operates as a ransomware-as-a-service (RaaS) model. After the group compromised his victims, they would threaten to publish the victim's sensitive data on their darknet blog named 'Happy Blog', unless the ransom is paid. The ransomware malware code used by REvil is pretty similar to the ransomware code used by DarkSide - a different threat actor. REvil group claims to steal information after a successful attack on the supplier of the tech giant Apple and stole confidential schematics of their upcoming products.

Active First seen Aug 2019
96Victims claimed on leak sites
0Victims in the last 30 days
0Victims in the last 90 days
14Countries hit
10Leak-site URLs tracked, 0 online
28 Nov 2022Latest claim recorded

Victimology

Who Revil claims to have breached, from 96 leak-site posts recorded by VULONE.

Claims per month last 12 months

Oct 2025: 0OctNov 2025: 0Dec 2025: 0Jan 2026: 0JanFeb 2026: 0Mar 2026: 0Apr 2026: 0AprMay 2026: 0Jun 2026: 0Jul 2026: 0JulAug 2026: 0Sep 2026: 0

Top sectors

Technology23
Manufacturing16
Healthcare10
Professional Services8
Financial Services6
Retail & E-Commerce6
Agriculture and Food Production6
Energy & Utilities5

Top countries

United States30
Australia4
United Kingdom3
France2
Argentina1
Japan1
Germany1
Spain1

Latest claimed victims 12 most recent

VictimSectorCountryClaimed
kusd.edu kusd.edu Education US 28 Nov 2022
Sunknowledge Services Inc Professional Services 28 Nov 2022
medibank.com.au medibank.com.au Healthcare AU 7 Nov 2022
Midea Group Manufacturing 1 Sep 2022
Doosan Group Manufacturing 2 Aug 2022
OptiProERP is a leading global provider of industry-specific ERP solutions for m Technology 25 Jul 2022
Ludwig Freytag Group Manufacturing 12 May 2022
Unicity International Professional Services 3 May 2022
Stratford University Education 22 Apr 2022
Asfaltproductienijmegen Manufacturing 21 Apr 2022
CYMZ Not Found 21 Apr 2022
www.oil-india.com oil-india.com Energy & Utilities 21 Apr 2022

All 96 Revil victims, searchable

Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.

Start free Sign in

Tactics, techniques and procedures

ATT&CK technique mapping for Revil is in progress. Victimology, infrastructure status and leak-site tracking are live above.

Indicators, detections and the full playbook

Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.

See full IOCs

Frequently asked

Is Revil ransomware still active?
Revil is tracked as active. The most recent leak-site claim VULONE recorded is dated 28 November 2022.
How many victims has Revil claimed?
VULONE has recorded 96 leak-site victim claims attributed to Revil since August 2019, across 14 countries and 13 sectors.
Which industries does Revil target?
The sectors most often named on the Revil leak site are Technology, Manufacturing, Healthcare.
Which countries are most affected by Revil?
Most Revil victims recorded by VULONE are located in United States, Australia, United Kingdom.
Where does VULONE get Revil victim data?
Claims are collected continuously from the group's own leak sites and cross-checked with ransomware.live and RansomLook. A claim is the group's assertion, not a confirmed breach.

VULONE research mentioning Revil

Other ransomware groups

Victim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 16 September 2026. Questions or corrections: [email protected].