Everest Ransomware

The Everest ransomware emerged in the second half of 2018, making attacks on several companies and large organisations, one example was the attack on the Brazilian government, more specifically on the national treasury and also on a network of the Attorney General of the National Treasury, these attacks were carried out in August 2021.

The Everest ransomware is part of the Everbe 2.0 family, which is composed of Embrace, PainLocker, EvilLocker and Hyena Locker ransomware.

The group uses the technique of double extortion, trying to increase the maximum profits obtained in their attacks, in this tactic payment is required not only to obtain the decryption key but also so that the company’s data is not disclosed. This method is used by most ransomware.

Ransomware Everest uses the tactic of spam emails, this tactic consists of filling the spam box with commercial emails from advertising companies, because in this case there is a chance that the malicious email goes straight to your inbox and not to the spam box.

This email has a Word or Excel file with “financial information”, they have files with a payload of malicious macros, which execute the ransomware attack. This is usually the port used by Everest ransomware.