REvil: Analysis of Competing Hypotheses

This ReliaQuest ACH report analyzes the sudden disappearance of the REvil (Sodinokibi) ransomware group in July 2021 by weighing six hypotheses — law enforcement action, technical difficulties, internal strife, rebrand, retirement, and mixed/wildcard scenarios — and concludes that law enforcement action and/or a rebrand are the most likely explanations while emphasizing persistent uncertainty and ongoing ransomware risk to organizations.