everest Ransomware
Monitorado desde 09/09/2021
3
vítimas registradas
3
nos últimos 30 dias
0
CVEs
3 d
Última atividade
Everest ransom group collects and analyzes information about their victims. They specialize in customer privacy data, financial information, databases, credit card information, and more. The Everest ransom group leaks the victim's data to the darknet and they announced that any victim that will not contact them will suffer from a data leak and they will not delete hist files for future usage.
Vulnerabilidades citadas para este grupo
CVEs associadas ao grupo pelo ransomware.live. Fichas ainda não publicadas aparecem sem link.
Nenhuma CVE associada a este grupo nas fontes.
Táticas e técnicas (MITRE ATT&CK)
Stealth
T1027 Obfuscated Files or InformationT1027.007 Obfuscated Files or Information: Dynamic API ResolutionT1078.003 Valid Accounts: Local AccountsT1112 Modify RegistryT1140 Deobfuscate/Decode Files or InformationT1480 Execution GuardrailsT1564 Hide ArtifactsT1622 Debugger Evasion Discovery
T1018 Remote System DiscoveryT1135 Network Share DiscoveryT1518.001 Software Discovery: Security Software DiscoveryT1614.001 System Location Discovery: System Language Discovery Lateral Movement
T1021.002 Remote Services: SMB/Windows Admin Shares Command and Control
T1071.001 Application Layer Protocol: Web Protocols Impact
T1486 Data Encrypted for ImpactT1489 Service StopT1490 Inhibit System Recovery Ferramentas observadas
Credential Theft
ProcDump
Discovery Enum
SoftPerfect NetScan
Offsec
Cobalt Strike · Metasploit · Meterpreter
RMM-Tools
AnyDesk · Atera · Splashtop
Países mais afetados (30 dias)
- Japão1
- Noruega1
- Estados Unidos1
Setores mais afetados (30 dias)
- Healthcare2
- Technology1
Vítimas divulgadas em sites de vazamento, segundo o ransomware.live. Não exibimos nomes de vítimas. · Ver no ransomware.live