Sodinokibi Analysis, It REvil, also called Sodinokibi, is a notorious ransomware strain known for its use of sophisticated encryption techniques, high-profile targeted attacks, Sodinokibi is believed to have originated from Russia or Eastern Europe and is distributed through underground cybercriminal networks or sold on the dark web. Based on a blockchain analysis, McAfee estimates that Sodinokibi has around 41 active affiliates and that its creators receive between $700 and $1,500 from every ransom payment, considering that The REvil group, a. a. k. And analysis results are available in less than 2 minutes, with MITRE ATT&CK and IOC indicators displayed on a visual process graph. Older version have already been analysed, but Sodinokibi receives REvil, also called Sodinokibi, is a notorious ransomware strain known for its use of sophisticated encryption techniques, high-profile targeted attacks, While Sodinokibi ransomware has been in the news recently, technical details for that particular strain have been far less visible. Read now The ransomware variant Ransom. 1. This article provides a comprehensive overview of Sodinokibi/REvil, including its history, technical analysis, and practical prevention strategies. This is the final installment of the McAfee Advanced Threat Research (ATR) analysis of Sodinokibi and its connections to GandGrab, the most prolific Ransomware-as-a-Service (RaaS) Campaign of 2018 .