Sodinokibi ransomware

Sodinokibi, also called REvil, is an affiliate-run ransomware family active from 2019 into 2022. Each attack adds a random extension of letters and digits, for example .686l0tek69, and the ransom note is a text file named after it, such as 686l0tek69-readme.txt. The wallpaper changes too. Victims are sent to a Tor payment page and asked to enter the key and extension from the note. Bitdefender publishes a free universal REvil/Sodinokibi decryptor that recovers files encrypted before 13 July 2021. Affiliates hit companies of every size, and in July 2021 used a flaw in Kaseya VSA to encrypt about sixty managed service providers and some 1,500 of their clients at once. A Linux build from mid-2021 encrypts ESXi virtual machines and NAS devices. Data was usually stolen first and posted on the Happy Blog leak site. The family is seen as the successor to GandCrab. Its servers went offline on 13 July 2021; the group came back that September with builds the free tool does not cover, and its last listed victim dates from November 2022.

File extensions: .686l0tek69, .686l0tek70, .686l0tek71, .686l0tek72, .686l0tek73, .686l0tek74, .686l0tek75, .686l0tek76, .686l0tek77, .686l0tek78, .686l0tek79, .686l0tek80, .686l0tek81, .686l0tek82, .686l0tek83, .686l0tek84, 05184, 0lhi4, 0oz7jxnt7, 1013om6wu, 187344, 1udrk, 248n223l, 260pc2, 299a5ba0r, 34urn3j, 3638lj8, 3mo533, 3yy010s, 46orz

Decryptor: A free decryptor is available.

Data exfiltration risk: High — Early adopter and major scaler of the double-extortion model (pioneered by Maze); exfiltrated corporate accounting files, IP secrets and customer records to its "Happy Blog" leak site prior to network-wide encryption. Leak site went offline after law-enforcement action in late 2021 and arrests in January 2022.

Systems typically targeted: Enterprise networks, MSP supply-chain hubs (e.g. the Kaseya VSA exploit) and critical infrastructure.

Do this first: Cut off MSP Remote Monitoring and Management (RMM) software integrations immediately to prevent centralized push-deployment across managed client networks.

Sources: No More Ransom