APT / THREAT GROUP

Sodinokibi

aliases

Intelligence Profile

Attackers are actively exploiting a recently disclosed vulnerability in Oracle WebLogic to install a new variant of ransomware called "Sodinokibi." Sodinokibi attempts to encrypt data in a user's directory and delete shadow copy backups to make data recovery more difficult. Oracle first patched the issue on April 26, outside of their normal patch cycle, and assigned it CVE-2019-2725. This vulnerability is easy for attackers to exploit, as anyone with HTTP access to the WebLogic server could carry out an attack. Because of this, the bug has a CVSS score of 9.8/10. Attackers have been making use of this exploit in the wild since at least April 17. Cisco's Incident Response (IR) team, along with Cisco Talos, are actively investigating these attacks and Sodinokibi.

Threat Analysis

Sodinokibi is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

Intelligence Reports Mentioning Sodinokibi

BKA Identifies REvil Leaders Behind 130 German Ransomware Attacks

The Hacker News· Apr 6, 2026

External References

→https://blog.talosintelligence.com/2019/04/sodinokibi-ransomware-exploits-weblogic.html

→https://www.zdnet.com/article/revil-ransomware-group-resurfaces-after-brief-hiatus

→https://www.macrumors.com/2021/04/26/revil-delists-stolen-apple-schematics-threat

→https://www.theverge.com/2021/7/22/22589643/ransomware-kaseya-vsa-decryptor-revil

→http://www.fsb.ru/fsb/press/message/single.htm%21id%3D10439388%40fsbMessage.html

→https://analyst1.com/file-assets/History-of-REvil.pdf

→https://angle.ankura.com/post/102hcny/revix-linux-ransomware

→https://blogs.vmware.com/security/2022/09/esxi-targeting-ransomware-the-threats-that-are-after-your-virtual-machines-part-1.html

→https://cybersecurity.att.com/blogs/labs-research/revils-new-linux-version

→https://cybleinc.com/2021/07/03/uncensored-interview-with-revil-sodinokibi-ransomware-operators/

Quick Facts

TypeAPT / Threat Group

Aliases3

Also Known As

REvilRevilSodinokibi

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Sodinokibi