Everest Ransomware
What Is Everest Ransomware?
Everest ransomware is a type of malware that encrypts the victim’s files and renders them completely inaccessible. The hackers then demand payment (often in the form of cryptocurrencies) in exchange for the decryption key.
The group behind this malware, Everest, has been responsible for multiple ransomware attacks and data breaches since 2020. The Russian-linked ransomware gang typically targets organizations, threatening to publish sensitive information on a data leak site if the organization doesn’t comply.
Notable victims of Everest ransomware attacks include the Brazilian Government, Coca-Cola, the U.S. space agency, NASA, and the cannabis retail chain, Stiiizy.
How Does It Work?
Everest specializes in acquiring and analyzing the victim’s customer privacy data, financial information, credit card information, databases, employee details, and so on. The hackers first find a viable target and infect their computer system or network, employing phishing emails, malicious downloads, exploit kits, or remote desktop protocol (RDP) vulnerabilities to spread within the target’s network.
The threat actor also performs network scans aimed at identifying potential targets within the network. Afterwards, the actor creates a list for potential ransomware deployment and then encrypts the victim’s files and adds a “.everest” extension to all affected files.
What’s more, it removes security and recovery tools, reconnaissance output files, and data collection archives to evade detection. This also minimizes the chances of data recovery without the attacker’s decryption key.
The attackers also leave a ransom message, which is either a pop-up window or a text file in the folders containing the corrupted files. The message displays the contact details and payment instructions for acquiring the decryption key. In other words, the perpetrators leave a cryptocurrency address for receiving the ransom, allowing the attackers to monitor payments while concealing their primary wallets.
