The Everest ransomware group has compromised Canadian telecommunications provider Rx Networks Inc, claiming to have exfiltrated 321 GB of corporate data. Discover the deep technical mechanics of Everest's attack chain, defense evasion, hostile Wake-on-LAN sweeps, and enterprise detection rules.
VPN/RDP compromise, bought credentials, or edge service exploit
Mutex checks, self-DACL restriction, disable Windows Defender, enable SMBv1
Broadcasting Wake-on-LAN magic packets over ports 7 & 9 to dormant devices
Background threads killing security/backups & dismantling Raccine
AES-128/RSA-1024 intermittent encryption & dropping EVERESTRANSOMWARE.txt
title: Everest Pre-Encryption Sabotage Sequencestatus: experimentallogsource: product: windows category: process_creationdetection: selection_powershell_cfa: Image|endswith: '\powershell.exe' CommandLine|contains|all: - 'Set-MpPreference' - 'EnableControlledFolderAccess' - 'Disabled' selection_powershell_smb1: Image|endswith: '\powershell.exe' CommandLine|contains|all: - 'Enable-WindowsOptionalFeature' - 'SMB1Protocol' selection_netsh: Image|endswith: '\netsh.exe' CommandLine|contains|all: - 'advfirewall' - 'new enable=Yes' selection_icacls: Image|endswith: '\icacls.exe' CommandLine|contains|all: - 'Everyone:F' - '/T /C /Q' condition: 3 of selection_*level: criticalIf your team may be exposed to a similar threat, FemtoSec can help validate blast radius, prioritize remediation, and connect the issue to a practical security program.
The Delhi Heart and Lung Institute has fallen victim to a major breach by the Krybit ransomware syndicate. The threat actors claim to have exfiltrated 22 GB of sensitive hospital, patient, employee, and corporate data, threatening public release within a short four-day window.
July 13, 2026
The Wallstreet ransomware group has listed Gold Standard Automotive Inc. on its data leak site, threatening to release exfiltrated databases, administrative credentials, and personal information within a five-day window. Learn about Wallstreet's TTPs and how to defend your enterprise infrastructure.
ANUBIS ransomware has targeted Quest Health Solutions, exfiltrating 239 GB of sensitive operational data. Operating under a dual-threat encryption and wiping model, this Go-based malware poses severe risks to healthcare infrastructure. Explore the technical attack chain, SIEM detection rules, and containment steps.
This original source is hosted on the Tor network. Use Tor Browser to open it, and treat the forum as untrusted while reviewing the post.
Onion URL
http://everestndkvzcibcje2cqxhre2hmmybl3rn2gwzwsblz7gx6uryn5rad.onion/news/rx-networks
Corporate networks face immediate operational disruption and regulatory exposure when sensitive internal data is targeted for public release by specialized double-extortion syndicates. When threat actors exfiltrate hundreds of gigabytes of proprietary documents, the resulting extortion window forces organizations to quickly validate their security posture and mitigate active lateral propagation. This security compromise demonstrates how advanced ransomware campaigns exploit vulnerable network entry points to execute systematic, multi-layered sabotage before deploying encryption payloads.
The Russian-linked Everest ransomware group has published Canadian location technology and telecommunications provider Rx Networks Inc. on its Tor-based leak portal. The threat group claims to have exfiltrated 321 GB of sensitive enterprise data from the target domain, rxnetworks.com. Following their standard double-extortion protocol, the threat actors established an 11 to 12 day countdown for the organization to meet their demands before publishing the stolen files online. This security incident underscores the operational vulnerabilities in network and telecommunications infrastructure when faced with highly persistent threat actors.
Active since late 2020, the Everest group is a sophisticated, Russian-speaking threat syndicate that operates a multi-stream monetization strategy. Unlike basic ransomware-as-a-service providers, Everest drives revenue through three distinct mechanisms: direct double-extortion campaigns, initial access brokering to sell persistent network footholds to other attackers, and corporate insider recruitment, where they actively solicit employees in Western nations to provide credentials for financial payouts.
Understanding how the Everest group operates requires looking beyond simple file encryption. The group relies on a multi-stage attack playbook designed to dismantle system defenses, wake up dormant endpoints, and gain complete control over domain directories.
Because Everest's pre-encryption phase is highly noisy, security operations teams can implement automated alert rules to catch this activity early.
Security teams should monitor process creation logs for the execution of multiple system modification utilities within a narrow time window. Below is a structured representation of the detection rule:
Everest secures its initial entry through remote access vectors, compromised VPN or RDP services, or through credentials purchased directly from initial access brokers. Attackers also exploit vulnerable edge devices. Regular Attack Surface Management is crucial to identify these exposed services and internet-facing assets before threat groups can exploit them.
Once the primary binary is executed, it runs an immediate sequence of checks and system modifications within the first five seconds to evade detection. The malware checks for the existence of a specific single-instance mutex (such as Global\7efc73f7-fda1-42d1-a4c5-8f1670bd08a5) to prevent duplicate running processes. It queries system LCID and culture settings, terminating immediately if a Commonwealth of Independent States (CIS) language profile is detected. To resist process termination by security monitoring tools, the binary inserts a custom deny-Everyone access control entry into its own DACL. Everest then issues PowerShell commands to disable Microsoft Defender's ransomware protections using the Set-MpPreference cmdlet. Finally, the malware re-enables the legacy SMBv1 protocol via DISM, modifies firewall profiles to allow network discovery, and adjusts registry keys to enable long file paths and linked connections.
With defense mechanisms weakened, the attack chain moves toward maximizing lateral coverage across the directory. The malware runs the icacls utility to grant Everyone full control permissions across all local volumes. Everest then parses the local ARP cache to enumerate active network endpoints. The malware sends Wake-on-LAN UDP magic packets across ports 7 and 9 to all discovered MAC addresses. This wakes up dormant workstations and servers, ensuring they are online and accessible for the subsequent encryption phase. The tool then queries five distinct system APIs to locate mapped network drives and active network file shares.
To prevent incident response teams from intervening, Everest spawns persistent background threads. Thread 1 closes reverse-engineering utilities, network monitors, and security analysis tools every 4 seconds. Thread 2 shuts down security services and database engines every 15 seconds, leveraging the Windows Restart Manager API to unlock occupied database files. Thread 3 terminates any process consuming more than 250 MB of memory every 2.5 seconds to disrupt sandbox analysis systems. The malware systematically targets and removes the open-source Raccine anti-ransomware utility by deleting its registry debugger associations, and shadow copies are destroyed using vssadmin and CIM commands.
Finally, the malware alters the system wallpaper and executes its encryption engine. It utilizes AES-128-CBC for files under 10 MB and intermittent chunked encryption for files over 10 MB to maximize speed. Files are appended with the .everest extension, and the ransom note (EVERESTRANSOMWARE.txt) is generated across every accessible folder.
title: Everest Pre-Encryption Sabotage Sequence
detection:
selection_powershell_cfa:
CommandLine|contains|all:
- 'Set-MpPreference'
- 'EnableControlledFolderAccess'
- 'Disabled'
selection_powershell_smb1:
CommandLine|contains|all:
- 'Enable-WindowsOptionalFeature'
- 'SMB1Protocol'
selection_netsh:
CommandLine|contains|all:
- 'advfirewall'
- 'new enable=Yes'
selection_icacls:
CommandLine|contains|all:
- 'Everyone:F'
- '/T /C /Q'
condition: 3 of selection_*Enterprise defenders should implement the following validation and containment policies:
Network-Level WoL Blocks: Configure internal network switches to block UDP traffic across ports 7 and 9 unless specifically required by authorized system administration utilities.
Automated EDR Isolation: Create automated rules to isolate endpoints instantly if a process attempts bulk directory modifications using icacls to grant Everyone permissions.
Credential Exposure Check: Because initial access is frequently secured via credential markets, checking corporate domain posture is an essential preventive measure.
If the domain already looks exposed, use Dark Web Scanner before requesting a full report.
Organizations within the GCC region and globally must transition from reactive patching to proactive validation. Implementing rigorous credential protection, deploying phishing-resistant multi-factor authentication, and carrying out advanced adversary simulations are key to stopping double-extortion schemes. To uncover hidden vulnerabilities in your perimeter before malicious actors can exploit them, consider scheduling a comprehensive Penetration Testing assessment with FemtoSec's offensive security experts. Contact our team at Office No. 264, Westburry Commercial Tower, Business Bay, Dubai, UAE, or call +971 4 269 7224 for a threat strategy consultation.