Sodinokibi ransomware

Sodinokibi, also called REvil, is an affiliate-run ransomware family active from 2019 into 2022. Each attack adds a random extension of letters and digits, for example .686l0tek69, and the ransom note is a text file named after it, such as 686l0tek69-readme.txt. The wallpaper changes too. Victims are sent to a Tor payment page and asked to enter the key and extension from the note. Bitdefender publishes a free universal REvil/Sodinokibi decryptor that recovers files encrypted before 13 July 2021. Affiliates hit companies of every size, and in July 2021 used a flaw in Kaseya VSA to encrypt about sixty managed service providers and some 1,500 of their clients at once. A Linux build from mid-2021 encrypts ESXi virtual machines and NAS devices. Data was usually stolen first and posted on the Happy Blog leak site. The family is seen as the successor to GandCrab. Its servers went offline on 13 July 2021; the group came back that September with builds the free tool does not cover, and its last listed victim dates from November 2022.

File extensions: .686l0tek69, .686l0tek70, .686l0tek71, .686l0tek72, .686l0tek73, .686l0tek74, .686l0tek75, .686l0tek76, .686l0tek77, .686l0tek78, .686l0tek79, .686l0tek80, .686l0tek81, .686l0tek82, .686l0tek83, .686l0tek84, 05184, 0lhi4, 0oz7jxnt7, 1013om6wu, 187344, 1udrk, 248n223l, 260pc2, 299a5ba0r, 34urn3j, 3638lj8, 3mo533, 3yy010s, 46orz

Decryptor: A free decryptor is available.