revil

REvil (also known as Sodinokibi) was one of the most financially damaging ransomware-as-a-service operations in history, attributed by the US government to a Russia-based criminal group (Pinchy Spider) with suspected FSB connections. Active 2019–2021, the group conducted landmark attacks including the Kaseya VSA supply chain attack affecting ~1,500 businesses and the JBS Foods attack, extorting over $200 million total. Russian authorities arrested 14 alleged REvil members in January 2022 in a rare cooperative action; subsequent prosecutions stalled amid geopolitical tensions following Russia's invasion of Ukraine. Former REvil affiliates contributed to ALPHV/BlackCat and other successor operations.