Skip to main content
Sodinokibi Ransomware

Sodinokibi, or Revil, is sophisticated RaaS tool supposedly created to replace the now retired GandCrab. Distribution campaigns are typically operated by affiliate users in direct partnership with Sodinokibi's creators.

Report a cyber attack: call 0300 303 5222 or email carecert@nhsdigital.nhs.uk

Summary

Sodinokibi, or Revil, is sophisticated RaaS tool supposedly created to replace the now retired GandCrab. Distribution campaigns are typically operated by affiliate users in direct partnership with Sodinokibi's creators.


Affected platforms

The following platforms are known to be affected:

Threat details

Introduction

First observed in April 2019, Sodinokibi (also known as Sodin or REvil) is a sophisticated human-operated ransomware-as-a-service (RaaS) tool. It is believed to have been created by the operators behind the older GandCrab ransomware following it's retirement in early 2019

Unlike most RaaS offerings, Sodinokibi's operators appear to directly hire affiliate users, promising them guaranteed payments in exchange for a lower overall percentage of any ransom.


Delivery

As with GandCrab, Sodinokibi is delivered as part of larger campaigns conducted by its affiliates. Most campaigns target vulnerable or misconfigured edge devices such as VPNs or firewalls to gain access to systems, before deploying Sodinokibi to all connected endpoints. Other affiliates have used phishing attacks or drive-by-downloads to distribute the ransomware.

Sodinokibi's creators forbid affiliate users from operating any campaigns in Commonwealth of Independant States member states, as well as Syria, with systems language checks built in to the ransomware to prevent this.


Activities

Once present on a system, Sodinokibi will perform several anti-analysis checks, as well as the aforementioned language check, before attempting to create new Run registry key entries to ensure persistence. If successful, it then terminates any processes or services that may have locks on before deleting backups and disabling recovery services. All non-system files are then encrypted using an unknown algorithm.


Remediation advice

If a device on your network becomes infected with ransomware it will begin encrypting files, which may also include remote files on network locations. The only guaranteed way to recover from a ransomware infection is to restore all affected files from their most recent backup. To limit the impact of a ransomware infection, NHS Digital advises that:

  • Critical data is frequently saved in multiple backup locations.
  • At least one backup is kept offline at any time (separated from live systems).
  • Backups and incident recovery plans are tested to ensure that data can be restored when needed.
  • User account permissions for modifying data are regularly reviewed and restricted to the minimum necessary.
  • Infected systems are disconnected from the network and powered down as soon as practicable.
  • Any user account credentials that may have been compromised should be reset on a clean device
  • Where infected systems cannot be quarantined with confidence, then an affected organisation should disconnect from national networks to limit propagation.

Additionally, to prevent and detect an infection, NHS Digital advises that:

  • Secure configurations are applied to all devices.
  • Security updates are applied at the earliest opportunity.
  • Tamper protection settings in security products are enabled where available.
  • Obsolete platforms are segregated from the rest of the network.
  • IT usage policies are reinforced by regular training to ensure all users know not to open unsolicited links or attachments.
  • Multi-factor authentication (MFA) and lockout policies are used where practicable, especially for administrative accounts.
  • Administrative accounts are only used for necessary purposes.
  • Remote administration services use strongly encrypted protocols and only accept connections from authorised users or locations.
  • Systems are continuously monitored, and unusual activity is investigated, so that a compromise of the network can be detected as early as possible.

Please note that NCSC maintains guidance for securely configuring a wide range of end user device (EUD) platforms. For further details refer to their end user device security guidance pages.


CVE Vulnerabilities

Last edited: 24 March 2021 12:19 pm