Cyritex Security Lab | The SODINOKIBI ransomware previously used by the REvil cyberattack group has now been added to the simulation attack library!

REvil came into the public eye in July 2021. It is a Ransomware-as-a-Service (RaaS) group, widely known for its high-profile attacks on companies like Kaseya, JBS Foods, and Apple Computer. In November 2021, Europol arrested and shut down several of the group's affiliates.

In June this year, the reportedly disbanded REvil ransomware group claimed responsibility for a Distributed Denial of Service (DDoS) campaign targeting a hospitality customer of cloud network provider Akamai. However, researchers said the attack was highly unlikely to be a resurgence of the notorious cyberattack group, but rather a copycat action by hobbyists.

Recently, after a well-known manufacturing enterprise in our country was attacked by ransomware, REvil allegedly claimed responsibility for the attack. However, whether or not it was carried out by the real REvil group, we should attach importance to understanding the entire process of ransomware attacks. Whether it is known or unknown ransomware, as long as we can detect and block the attack chain before the final data exfiltration and data encryption, we have a chance to ultimately stop the extortion from happening, without having to bet everything on the capabilities of endpoint/host security products and data backups (although these measures are necessary means to prevent ransomware).

▌Brief Introduction to the New SODINOKIBI Variant

SODINOKIBI is ransomware written in C that encrypts files stored on local and network shared folders. It can delete files from specified directories, backup files, and shadow copies (such as using vssAdmin to delete shadow volumes) to prevent victims from recovering data, leaving a readme file containing instructions on how to pay the "ransom". Before executing the final attack action, SODINOKIBI attackers will use registry run keys to maintain persistence, adding an entry to the "Run keys" in the registry or startup folder so that it can be executed when the user logs in. SODINOKIBI also uses BCDEdit to suppress system recovery, and uses BCDEdit to change the "Safeboot" setting to "minimal" in an attempt to block antivirus software from starting. These methods are also used by various other ransomware strains. The REvil group extensively used SODINOKIBI and its variants in its attack campaign against Kaseya.

▌Breach and Attack Simulation Library Update

You can now directly search for SODINOKIBI on our platform to get all attack simulation scenarios related to SODINOKIBI, including the execution of this ransomware and the network download of its variants, to test the detection and defense capabilities of your network security and endpoint/host defense measures against this ransomware, its variants, and its behaviors. Currently, we have collected up to 14 variants in our threat library.