Everest

Everest is a Russia-linked, Russian-speaking ransomware and extortion operation active since at least late 2020. It has used double extortion, combining data theft, file encryption, and threats to publish stolen data, and later increasingly emphasized encryptionless data-theft extortion. The operation has also acted as an initial-access broker, reselling footholds in compromised networks and, at times, using data obtained by other actors for extortion.

Everest has targeted organizations in government, healthcare, telecommunications, finance, manufacturing, transportation, and other sectors across North America, Europe, and Asia. Reported intrusion methods include phishing, exploitation of vulnerable public-facing applications, and use of stolen credentials.

Observed Everest ransomware payloads are .NET-based and use obfuscation and anti-analysis protections. The encryptor can terminate security and analysis tools, disable Windows security controls, delete shadow copies and backup-related data, remove anti-ransomware protections, and self-delete after execution. It uses geofencing to avoid systems configured for Commonwealth of Independent States locales and can use Wake-on-LAN broadcasts to activate sleeping systems before encryption. File encryption uses symmetric cryptography with asymmetric protection of encryption keys; larger files may be only partially encrypted to accelerate impact across large data volumes. Data theft, where conducted, appears to occur through tooling separate from the encryptor.