REvil disappears following pressure on Russia to act on ransomware gangs SHARE Ransomware gang REvil has disappeared following pressure from the U.S. government on Russia to act on ransomware groups operating in the country. The REvil ransomware gang, also known as Sodinokibi, dates back to 2018 and is believed to be an offshoot of the now-defunct GandCrab ransomware gang. REvil, in its three years, has been prolific in its attacks. SiliconANGLE first reported on the group in May 2019 following an attack exploiting a vulnerability on Oracle Corp.’s WebLogic Server and has regularly done so since. Notable REvil ransomware attacks include CyrusOne Inc. in December 2019; Travelex the same month, a notable target as the company subsequently paid the ransom; celebrity law firm Grubman Shire Meiselas & Sacks in May 2020; video games maker Capcom Co. Ltd. in November; U.K. cosmetic surgery provider Transform Hospital Group Ltd. in December; and insurance company CNA Financial Corp. in March.