Ransomware group profile · #71 by claimed victims
Revil ransomware
Sodinokibi ransomware group also known as REvil (Ransomware Evil) operates as a ransomware-as-a-service (RaaS) model. After the group compromised his victims, they would threaten to publish the victim's sensitive data on their darknet blog named 'Happy Blog', unless the ransom is paid. The ransomware malware code used by REvil is pretty similar to the ransomware code used by DarkSide - a different threat actor. REvil group claims to steal information after a successful attack on the supplier of the tech giant Apple and stole confidential schematics of their upcoming products.
Victimology
Who Revil claims to have breached, from 96 leak-site posts recorded by VULONE.
Claims per month last 12 months
Top sectors
Top countries
Latest claimed victims 12 most recent
| Victim | Sector | Country | Claimed |
|---|---|---|---|
| kusd.edu kusd.edu | Education | US | 28 Nov 2022 |
| Sunknowledge Services Inc | Professional Services | — | 28 Nov 2022 |
| medibank.com.au medibank.com.au | Healthcare | AU | 7 Nov 2022 |
| Midea Group | Manufacturing | — | 1 Sep 2022 |
| Doosan Group | Manufacturing | — | 2 Aug 2022 |
| OptiProERP is a leading global provider of industry-specific ERP solutions for m | Technology | — | 25 Jul 2022 |
| Ludwig Freytag Group | Manufacturing | — | 12 May 2022 |
| Unicity International | Professional Services | — | 3 May 2022 |
| Stratford University | Education | — | 22 Apr 2022 |
| Asfaltproductienijmegen | Manufacturing | — | 21 Apr 2022 |
| CYMZ | Not Found | — | 21 Apr 2022 |
| www.oil-india.com oil-india.com | Energy & Utilities | — | 21 Apr 2022 |
All 96 Revil victims, searchable
Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.
Tactics, techniques and procedures
ATT&CK technique mapping for Revil is in progress. Victimology, infrastructure status and leak-site tracking are live above.
Indicators, detections and the full playbook
Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.
Frequently asked
Is Revil ransomware still active?
How many victims has Revil claimed?
Which industries does Revil target?
Which countries are most affected by Revil?
Where does VULONE get Revil victim data?
VULONE research mentioning Revil
Other ransomware groups
Victim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 16 September 2026. Questions or corrections: [email protected].