REvil Ransomware Uses DLL Sideloading

This McAfee analysis details the REvil/Sodinokibi ransomware campaign, including DLL side‑loading via a signed Microsoft binary, RC4/Salsa20-based payload and encryption, localization checks to avoid certain countries, termination of wide-ranging applications and services, evidence of exploitation through CVE-2019-2725 and Kaseya VSA, and provided IOCs and mitigation recommendations.