HOMETHREATSREvil
MALWARE FAMILY

REvil

Internal ID: elf.revil
90
victims
1
aliases
Last seen:Mar 17, 2026

Intelligence Profile

ELF version of win.revil targeting VMware ESXi hypervisors.

Threat Analysis

REvil is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

Ransomware Victims (90)

CTIWATCH tracks 90 organizations claimed as victims by REvil on its data leak site, with attack dates, sectors and countries.

View full victims list →

External References

→http://www.fsb.ru/fsb/press/message/single.htm%21id%3D10439388%40fsbMessage.html
→https://analyst1.com/file-assets/History-of-REvil.pdf
→https://angle.ankura.com/post/102hcny/revix-linux-ransomware
→https://blogs.vmware.com/security/2022/09/esxi-targeting-ransomware-the-threats-that-are-after-your-virtual-machines-part-1.html
→https://cybersecurity.att.com/blogs/labs-research/revils-new-linux-version
→https://cybleinc.com/2021/07/03/uncensored-interview-with-revil-sodinokibi-ransomware-operators/
→https://diicot.ro/mass-media/3341-comunicat-de-presa-2-08-11-2021
→https://documents.trendmicro.com/assets/rpt/rpt-navigating-new-frontiers-trend-micro-2021-annual-cybersecurity-report.pdf
→https://github.com/f0wl/REconfig-linux
→https://home.treasury.gov/news/press-releases/jy0471

Quick Facts

TypeMalware Family
Aliases1

Also Known As

elf.revil

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·REvil Victims (90)·Geopolitics Map·Search REvil