REvil (Sodinokibi)
A Russian-speaking ransomware group active from 2019 to 2022, behind the JBS and Kaseya attacks, several of whose members were arrested by Russia's FSB in January 2022 at the request of the United States.
REvil was one of the first groups to industrialize ransomware as a service, with affiliates and aggressive public messaging. It pushed ransom sizes to unprecedented levels, targeting companies whose every hour of downtime costs more than the ransom, then going through IT service providers to hit their clients all at once. Its fate sheds light on the political dimension of ransomware: the group vanished after the US president publicly asked Moscow to act, and its members were arrested only when Russia was looking for a gesture toward Washington, a few weeks before the invasion of Ukraine. Cracking down on ransomware therefore depends on relations between states as much as on police resources.
In June 2021, meat processor JBS paid REvil 11 million dollars. On July 2, 2021, the Kaseya attack hit up to 1,500 businesses, and REvil demanded 70 million dollars for a universal decryptor. On January 14, 2022, the FSB announced the arrest of group members and the seizure of more than 426 million rubles, 600,000 dollars, 500,000 euros and twenty cars.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.