REvil Ransomware Decryption & Data Recovery

REvil (Ransomware Evil, also tracked as Sodinokibi and Sodin) surfaced publicly in April 2019, first observed when attackers dropped the encryptor through the Oracle WebLogic deserialisation flaw CVE-2019-2725. Multiple vendors - Sophos/Secureworks CTU, CrowdStrike and Unit 42 - found near-identical string-decoding routines and URL-building logic shared with GandCrab, and the consensus is that REvil was GandCrab's continuation under the operator cluster tracked as GOLD SOUTHFIELD / PINCHY SPIDER.

It ran as ransomware-as-a-service: a core team supplied the encryptor, the negotiation portal and the Happy Blog leak site, while affiliates handled intrusion and deployment for a revenue share. 2020-2021 was its peak - the Grubman Shire Meiselas & Sacks law-firm breach, $50 million demands against Acer and Apple supplier Quanta, an $11 million payment from JBS in May 2021, and in July 2021 the Kaseya VSA zero-day (CVE-2021-30116) that reached the downstream customers of hundreds of MSPs in a single campaign with a $70 million ask. Unit 42 put the average payment across the cases it observed in the first half of 2021 at roughly $2.25 million.

Kaseya triggered unprecedented diplomatic and law-enforcement pressure. On 13 July 2021 every REvil site went offline without warning; in October a multinational operation took over its servers; in January 2022 Russia's FSB announced arrests and charges. The brand never genuinely returned - public leak-site trackers record the last posting on 28 November 2022, roughly a hundred victims in total (counts vary between trackers), and more than three years of silence since.

The legal reckoning continued. In May 2024 Ukrainian national Yaroslav Vasinskyi, the operator behind the Kaseya deployment, received 13 years and 7 months in the United States plus $16 million restitution. In October 2024 a Russian court sentenced four members to more than four years; in June 2025 those four walked free with pre-trial detention counted as time served. In April 2026 Germany's Federal Criminal Police Office (BKA) publicly named two Russian nationals as the heads of GandCrab and REvil.

What this means today. REvil is not a live threat, but it still turns up in incident response in three forms: legacy encrypted data that may qualify for free decryption, copycat samples that borrow its extension and note format, and intrusion paths it opened years ago that were never properly cleaned.

Extension. REvil uses no fixed extension. Each victim host receives a random 5-10 character alphanumeric suffix, so report.xlsx becomes report.xlsx.9781xsd4. Every encrypted file on that host shares the suffix, but it differs between hosts - which is why searching by extension so often fails for this family and the note has to be used instead.

Ransom note. The filename is built from that suffix - [random-ext]-HOW-TO-DECRYPT.txt, for example 88f2947s-HOW-TO-DECRYPT.txt - so its leading segment matches the encryption suffix exactly. The English text supplies a per-victim key/UID plus a Tor negotiation address; early versions also listed a clearnet gateway domain such as decryptor.top so victims could reach the portal without Tor.

Wallpaper. One of the most distinctive traits. REvil generates a grainy blue background with centred white text reading "You are infected! Read [random-ext]-HOW-TO-DECRYPT.txt!" - seeing that wallpaper is close to a positive identification on its own.

System-side artefacts.

• Volume shadow copies deleted and Windows recovery disabled.
• Session public-key configuration left in the registry.
• Some builds accept a -smode argument that reboots into Safe Mode before encrypting, to evade endpoint protection.
• On ESXi hosts, traces of esxcli force-killing every running VM, with vmdk files under /vmfs/volumes encrypted.

Bottom line. Random extension plus a HOW-TO-DECRYPT note plus the blue grainy wallpaper together attribute the family with high confidence. Whether the data is freely decryptable, however, depends on the encryption date and build, and copycat samples can look identical while using a different key hierarchy.

REvil ran a multi-vector operation in which each affiliate brought its own tradecraft. The access routes that recur across public analyses are:

• Internet-facing application and edge-device flaws. Oracle WebLogic CVE-2019-2725 (the earliest observed delivery), Pulse Secure VPN CVE-2019-11510 - which CISA explicitly linked to REvil in its top routinely exploited vulnerabilities advisory - and Fortinet FortiOS CVE-2018-13379.
• Supply chain. In July 2021 the Kaseya VSA zero-day CVE-2021-30116 was used to push the encryptor from an MSP remote-management platform down to its customers en masse. This was REvil's most destructive campaign and the pattern enterprises should study hardest: compromise the outsourced IT or management platform and the whole estate falls at once.
• Exposed RDP and credential brute force, followed by direct interactive logon with valid credentials.
• Phishing and weaponised documents delivering a loader, then a post-exploitation framework.
• Watering holes and compromised software distribution channels in the earlier period.
• Lateral movement and privilege escalation. Credential dumping, then mass deployment via PsExec, scheduled tasks or GPO once the domain controller was taken.

Affiliates typically completed exfiltration and mapped the backup estate before detonating, choosing a weekend or holiday night. The value of this list today is not defending against REvil but recognising that LockBit, Akira and Qilin still use the same doors - the ones left open back then are usually still open.

Algorithms. File contents are encrypted with the Salsa20 stream cipher under a unique per-file key. The key hierarchy is entirely elliptic-curve based (Curve25519/ECDH): each file gets its own keypair, the file key is derived as SHA3-256 of the ECDH shared secret, and the corresponding public key and configuration are written alongside the encrypted data, while the session private key is stored encrypted under the operators' public key. Nothing can be reversed from ciphertext alone - the September 2021 free decryptor exists because law-enforcement action put key material in a partner's hands, not because the cryptography was broken.

Encryption scope is a build-time setting and has to be determined per sample. REvil's configuration carries a fast-encryption switch (recorded as fast / flag_fast in Kaspersky's Sodin analysis): when set, only the leading portion of each file is encrypted, capped at roughly 1MB; when unset, the file is encrypted in full. So the scope can differ between builds, and even between batches inside one incident. Large files may turn out to have only their headers overwritten, leaving real structural-repair headroom - or database files (MDF/LDF, DBF, ibd) and virtual disks (vmdk/vhdx) may be overwritten end to end. Do not assume either case: pull real encrypted files and inspect where ciphertext actually starts and stops (is the middle or tail of the file still recognisable plaintext structure?), then decide whether structural repair is viable.

Recovery inhibition. It runs vssadmin.exe Delete Shadows /All /Quiet to remove shadow copies and uses bcdedit to disable the recovery environment and boot failure policy (recoveryenabled No, bootstatuspolicy ignoreallfailures), while terminating database, mail and backup-agent processes holding files open.

Safe Mode and evasion. Some builds accept a -smode argument that reboots into Safe Mode before encrypting, bypassing endpoint agents that do not start there.

Linux / ESXi / NAS. An ELF64 encryptor surfaced in mid-2021 - a public sample was disclosed in late June 2021 - running 50 threads by default and taking a --path argument plus a silent-mode flag. It first uses esxcli to force-kill every running VM so vmdk files under /vmfs are not locked and corrupted during encryption, and it also targets NAS appliances.

Double extortion. REvil was one of the early drivers of the model: data was stolen before encryption and published or auctioned in stages on Happy Blog if no payment came.