REvil Twins: Ransomware-as-a-Service program

This report provides an overview of the REvil (Sodinokibi) ransomware-as-a-service operation, describing affiliate recruitment and behavior, high-value incidents (e.g., Acer, JBS), rising ransom demands, common initial access vectors (phishing, malicious Office macros, RDP, purchased access, ProxyLogon/web shells), use of loaders like IcedID and Qakbot, post-exploitation tools (Cobalt Strike, Mimikatz, ProcDump), data exfiltration methods (WinSCP, cloud sync), and practical detection/hunting tips mapped to MITRE ATT&CK.