Unknown
Unknown, also referred to as UNKN, is identified in the provided content as the main actor associated with advertising and promoting the REvil ransomware-as-a-service operation. REvil is also known as Sodinokibi or Sodin. According to the content, REvil was first observed in April 2019 exploiting Oracle WebLogic vulnerability CVE-2019-2725 and was advertised on a Russian-language cybercrime forum in June 2019. The operation used an affiliate model in which operators maintained the malware and payment infrastructure while affiliates acquired victims, with affiliates reportedly receiving 60% to 70% of ransom payments. The content states Intel 471 assessed REvil was likely a continuation of the GandCrab RaaS operation with new software but operated by the same individuals, and that Unknown stated the operators had been GandCrab affiliates, bought the source code, and developed custom features for their own operation. Technically, the REvil malware described in the content is highly configurable and uses RC4-encrypted JSON configuration data, runtime string decryption, and dynamic API resolution. It communicates with controllers over HTTPS and contains more than 1,000 controller domains in configuration, with many believed to be decoys. REvil supports privilege escalation, including prior use of CVE-2018-8453 before its removal in version 2.1, and attempts UAC elevation via ShellExecuteW. It stops and deletes services, terminates processes, deletes shadow copies, encrypts local and network files, appends random extensions, drops ransom notes, and changes the desktop background. Its encryption workflow uses Curve25519, Salsa20, SHA-3, AES, and CRC32. The malware stores encrypted victim key material in the registry and includes operator master key capability allowing operators to decrypt files independently of affiliates. The provided content does not attribute Unknown to a nation state. The separate mention that a framework was observed in use primarily by Chinese APT groups refers to Scanbox activity in Cisco Web VPN compromises and does not directly identify Unknown as that actor.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
22 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
1 malware family attributed to this actor across reporting.
Associated vulnerabilities
6 CVEs this actor has used in observed campaigns. 6 of them exploited in the wild.
The known vulnerabilities that Rabbot is capable of exploiting include the following: ... CVE-2015-2051 ...
The known vulnerabilities that Rabbot is capable of exploiting include the following: ... CVE-2016-0792 ...
The known vulnerabilities that Rabbot is capable of exploiting include the following: ... CVE-2017-6884 ...
The known vulnerabilities that Rabbot is capable of exploiting include the following: CVE-2018-1149 ...
The known vulnerabilities that Rabbot is capable of exploiting include the following: ... CVE-2018-9866 ...
1 more CVE tied to this actor tracked in Mallory.
Observables
36 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.