Revil
From extortion.wiki, the ransomware notes archive
3 archived notes associated with the upstream family directory revil. The family label follows ThreatLabz; any link to negotiation records uses an explicit archive alias mapping.
Archived note files
3 supported · 0 skipped| Original filename | File type | Content hash | Source | Internal archive |
|---|---|---|---|---|
| revil1.txt | Plain text (.txt) | 2ef3791fb3803a0e… | Upstream file | Read archived source |
| revil2.txt | Plain text (.txt) | 829cdb758c3fd7c0… | Upstream file | Read archived source |
| revil3.txt | Plain text (.txt) | 3deba5f96366f623… | Upstream file | Read archived source |
Negotiation records
Threat actor page: REvilAn explicit archive alias maps the ThreatLabz family Revil to the Ransomchats actor label REvil. Note and negotiation counts remain separate.
| Participants | Source | Archive status | |||
|---|---|---|---|---|---|
| 20210709 | 1 | REvil | JSON | Indexed | |
| 20210709 | 28 | REvil, Victim | JSON | Indexed | |
| 20210630 | 42 | REvil, Victim | JSON | Indexed | |
| 20210628 | 39 | REvil, Victim | JSON | Indexed | |
| 20210622 | 52 | REvil, Victim | JSON | Indexed | |
| 20210617 | 67 | REvil, Victim | JSON | Indexed | |
| 20210616 | 31 | REvil, Victim | JSON | Indexed | |
| 20210613 | 132 | REvil, Victim | JSON | Indexed | |
| 20210609 | 58 | REvil, Victim | JSON | Indexed | |
| 20210604 | 10 | REvil, Victim | JSON | Indexed | |
| 20210603 | 63 | REvil, Victim | JSON | Indexed | |
| 20210413 | 156 | REvil, Victim | JSON | Indexed | |
| 20210407 | 15 | REvil, Victim | JSON | Indexed | |
| 20210401 | 78 | REvil, Victim | JSON | Indexed | |
| 20210331 | 23 | REvil, Victim | JSON | Indexed | |
| 20210329 | 43 | REvil, Victim | JSON | Indexed | |
| 20210320 | 13 | REvil, Victim | JSON | Indexed | |
| 20201126 | 79 | REvil, Victim | JSON | Indexed | |
| 20201104 | 63 | REvil, Victim | JSON | Indexed | |
| 20201014 | 72 | REvil, Victim | JSON | Indexed |
Dataset provenance and citation
| Upstream collector | Zscaler ThreatLabz |
|---|---|
| Source repository | ThreatLabz/ransomware_notes |
| Source directory | revil |
| Snapshot commit | 2bbf5b4ecda84837c4a71af1a99c6821920f051a |
| Dataset snapshot | Jun 26, 2026, 10:27 PM |
| Synchronization time | Jul 22, 2026, 11:47 AM |
| Source status | Complete |
| License | MIT; preserved notice |
| Stable internal citation | extortion.wiki. Revil ransomware notes. ThreatLabz/ransomware_notes snapshot 2bbf5b4ecda84837c4a71af1a99c6821920f051a. https://extortion.wiki/notes/revil/. |