Sodinokibi ransomware

Sodinokibi, also called REvil, is an affiliate-run ransomware family active from 2019 into 2022. Each attack adds a random extension of letters and digits, for example .[random_number], and the ransom note is a text file named after it, such as [random_number]-readme.txt. The wallpaper changes too. Victims are sent to a Tor payment page and asked to enter the key and extension from the note. Bitdefender publishes a free universal REvil/Sodinokibi decryptor that recovers files encrypted before 13 July 2021. Affiliates hit companies of every size, and in July 2021 used a flaw in Kaseya VSA to encrypt about sixty managed service providers and some 1,500 of their clients at once. A Linux build from mid-2021 encrypts ESXi virtual machines and NAS devices. Data was usually stolen first and posted on the Happy Blog leak site. The family is seen as the successor to GandCrab. Its servers went offline on 13 July 2021; the group came back that September with builds the free tool does not cover, and its last listed victim dates from November 2022.

Sources: In-house research

File extensions: .[random_number]

Decryptor: A decryptor exists but covers only some builds. Checked 2026-11-05.

Scope: Bitdefender's free universal REvil/Sodinokibi decryptor recovers files from attacks made before 13 July 2021. A separate free Emsisoft tool covers victims of the July 2021 Kaseya supply-chain attack. Attacks after 13 July 2021 are not covered.

Data exfiltration risk: High — Early adopter and major scaler of the double-extortion model (pioneered by Maze); exfiltrated corporate accounting files, IP secrets and customer records to its "Happy Blog" leak site prior to network-wide encryption. Leak site went offline after law-enforcement action in late 2021 and arrests in January 2022.

Systems typically targeted: Enterprise networks, MSP supply-chain hubs (e.g. the Kaseya VSA exploit) and critical infrastructure.

Do this first: Cut off MSP Remote Monitoring and Management (RMM) software integrations immediately to prevent centralized push-deployment across managed client networks.

From the ransom note random-string-HOW-TO-DECRYPT.txt:

--=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion [random_number]. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] […]

Link to decryptor: Bitdefender