{ "id": "98d2e8bf-2cef-4ebf-b60f-af3962920966", "created_at": "2026-04-06T01:31:48.076311Z", "updated_at": "2026-04-10T03:22:00.224664Z", "deleted_at": null, "sha1_hash": "0c75b3c98813a4625454bfd218e16e2f52ac994a", "title": "Netskope Threat Coverage: REvil", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 103981, "plain_text": "Netskope Threat Coverage: REvil\r\nBy Gustavo Palazolo\r\nPublished: 2021-07-07 · Archived: 2026-04-06 00:31:42 UTC\r\nSummary\r\nThe REvil ransomware (a.k.a Sodinokibi) is a threat group that operates in the RaaS (Ransomware-as-a-Service)\r\nmodel, where the infrastructure and the malware are supplied to affiliates, who use the malware to infect target\r\norganizations. On July 2, the REvil threat group launched a supply chain ransomware attack using an exploit in\r\nKaseya’s VSA remote management software. REvil claims to have infected more than one million individual\r\ndevices around the world. The attackers demanded $45,000 USD to restore the files from a single infected device,\r\nor $70 million USD paid in BTC for a universal decrypter that will allegedly work for all of the victims of the\r\nKaseya attack. This threat is targeting anyone with Kaseya’s VSA Remote Management Platform agent installed\r\non Microsoft Windows systems (any version).\r\nThreat \r\nThe REvil group has likely used a zero-day exploit against Kaseya’s management server, allowing the attackers to\r\ndeploy the malware remotely on Windows devices running the VSA agent application. The first step executed by\r\nthe group was to deploy a base64-encoded file to Kaseya’s working directory, which was probably ignored by\r\nanti-virus engines as recommended by Kaseya.\r\nOnce the encoded file ( agent.crt ) was deployed, the attacker executed a set of shell commands remotely to\r\ndecode and execute the payload, as well as to disable the Windows Defender protections. The decoded file\r\n( agent.exe ) is a malware dropper that writes to disk two different files:\r\n1. MsMpEng.exe : This is an outdated version of Microsoft’s Antimalware Service that is vulnerable to a\r\ntechnique known as DLL Hijacking.\r\n2. mpsvc.dll : This is the packed REvil payload, which is loaded by MsMpEng.exe through the DLL\r\nHijacking technique.\r\nhttps://www.netskope.com/blog/netskope-threat-coverage-revil\r\nPage 1 of 9\n\n“Agent.exe” writing REvil packed payload “mpsvc.dll” to disk\r\nOnce executed, the REvil packed sample loads and executes a small shellcode, which is responsible for unpacking\r\nand executing the final payload, which contains an encrypted configuration within the binary.\r\nhttps://www.netskope.com/blog/netskope-threat-coverage-revil\r\nPage 2 of 9\n\nREvil ransomware encrypted configuration\r\nThe data is encrypted with RC4, so we can use a small Python script to decrypt it:\r\nhttps://www.netskope.com/blog/netskope-threat-coverage-revil\r\nPage 3 of 9\n\nDecrypting REvil configuration using Python\r\nAfter decrypting the configuration, we can obtain more detailed information about the sample, such as the\r\n“affiliate” ID, ignored folders, C2 domains, etc.\r\nhttps://www.netskope.com/blog/netskope-threat-coverage-revil\r\nPage 4 of 9\n\nPart of the decrypted REvil configuration\r\nIn this case, the “net” option is set to “false” in the configuration, which tells the ransomware to ignore the C2\r\naddresses. However, in case this option is set to “true,” the malware sends a POST request to available addresses\r\nwith information about the infected machine, such as the encryption key and the machine name.\r\nhttps://www.netskope.com/blog/netskope-threat-coverage-revil\r\nPage 5 of 9\n\nREvil ransomware preparing to send the POST request to the C2\r\nWithin this REvil configuration, we have found 1,221 unique domains that could be used for network\r\ncommunication.\r\nAfter encrypting the files, REvil changes the user’s background:\r\nhttps://www.netskope.com/blog/netskope-threat-coverage-revil\r\nPage 6 of 9\n\nImage set by REvil as the user’s background\r\nAlso, the ransom note is created in the directories where there are encrypted files:\r\nhttps://www.netskope.com/blog/netskope-threat-coverage-revil\r\nPage 7 of 9\n\nPart of REvil ransom note\r\nProtection\r\nNetskope Threat Labs is actively monitoring this campaign and has ensured coverage for all known threat\r\nindicators and payloads. \r\nNetskope Threat Protection\r\nGeneric.Ransom.Sodinokibi.B.8FB3E6FD\r\nGen:Variant.Ransom.Sodinokibi.61\r\nGen:Variant.Razy.525651\r\nNetskope Advanced Threat Protection provides proactive coverage against this threat.\r\nGen.Malware.Detect.By.StHeur  indicates a sample that was detected using static analysis\r\nGen.Malware.Detect.By.Sandbox indicates a sample that was detected by our cloud sandbox\r\nSample Hashes\r\nhttps://www.netskope.com/blog/netskope-threat-coverage-revil\r\nPage 8 of 9\n\nName sha256\r\nagent.exe d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e\r\nmpsvc.dll e2a24ab94f865caeacdf2c3ad015f31f23008ac6db8312c2cbfb32e4a5466ea2\r\nmpsvc.dll 8dd620d9aeb35960bb766458c8890ede987c33d239cf730f93fe49d90ae759dd\r\nunpacked 5286889a725a109df74bdee612ce2c288a61970d3126c466c4e8c5cde1cc23c3\r\nA full list of sample hashes, domains, and a tool to extract and decrypt the config from a REvil sample are\r\navailable in our Git repo.\r\nSource: https://www.netskope.com/blog/netskope-threat-coverage-revil\r\nhttps://www.netskope.com/blog/netskope-threat-coverage-revil\r\nPage 9 of 9", "extraction_quality": 1, "language": "EN", "sources": [ "Malpedia" ], "references": [ "https://www.netskope.com/blog/netskope-threat-coverage-revil" ], "report_names": [ "netskope-threat-coverage-revil" ], "threat_actors": [], "ts_created_at": 1775439108, "ts_updated_at": 1775791320, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/0c75b3c98813a4625454bfd218e16e2f52ac994a.pdf", "text": "https://archive.orkl.eu/0c75b3c98813a4625454bfd218e16e2f52ac994a.txt", "img": "https://archive.orkl.eu/0c75b3c98813a4625454bfd218e16e2f52ac994a.jpg" } }