MITRE ATT&CK Malware

REvil (S0496)

SodinSodinokibi

ShareX LinkedIn Reddit HN

[REvil](https://attack.mitre.org/software/S0496) is a ransomware family that has been linked to the [GOLD SOUTHFIELD](https://attack.mitre.org/groups/G0115) group and operated as ransomware-as-a-service (RaaS) since at least April 2019. [REvil](https://attack.mitre.org/software/S0496), which as been used against organizations in the manufacturing, transportation, and electric sectors, is highly configurable and shares code similarities with the GandCrab RaaS.(Citation: Secureworks REvil September 2019)(Citation: Intel 471 REvil March 2020)(Citation: Group IB Ransomware May 2020)

Platforms: Windows

▪Techniques implemented (43)

T1486Data Encrypted for Impact T1059.003Windows Command Shell T1059.001PowerShell T1573.002Asymmetric Cryptography T1055Process Injection T1036.005Match Legitimate Resource Name or Location T1112Modify Registry T1485Data Destruction T1012Query Registry T1059.005Visual Basic T1041Exfiltration Over C2 Channel T1489Service Stop T1082System Information Discovery T1106Native API T1204.002Malicious File T1134.002Create Process with Token T1685Disable or Modify Tools T1480.002Mutual Exclusion T1083File and Directory Discovery T1027.013Encrypted/Encoded File T1189Drive-by Compromise T1007System Service Discovery T1047Windows Management Instrumentation T1140Deobfuscate/Decode Files or Information T1566.001Spearphishing Attachment T1105Ingress Tool Transfer T1688Safe Mode Boot T1680Local Storage Discovery T1614.001System Language Discovery T1134.001Token Impersonation/Theft T1071.001Web Protocols T1069.002Domain Groups T1070.004File Deletion T1490Inhibit System Recovery T1027.011Fileless Storage T0863User Execution T0881Service Stop T0849Masquerading T0882Theft of Operational Information T0828Loss of Productivity and Revenue T0869Standard Application Layer Protocol T0886Remote Services T0853Scripting

▪Used by groups (2)

G0046FIN7 G0115GOLD SOUTHFIELD

S0496on MITRE ATT&CK →

MITRE ATT&CK® is a registered trademark of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.