{"id":2125,"date":"2021-05-19T13:27:00","date_gmt":"2021-05-19T11:27:00","guid":{"rendered":"https:\/\/fortgale.com\/news\/?p=2125"},"modified":"2023-12-20T11:34:10","modified_gmt":"2023-12-20T11:34:10","slug":"revil-ransomware-operator-a-time-zone-analysis","status":"publish","type":"post","link":"https:\/\/fortgale.com\/blog\/featured\/revil-ransomware-operator-a-time-zone-analysis\/","title":{"rendered":"REvil Ransomware Operator: A time zone analysis"},"content":{"rendered":"\n

In April 2021, an unidentified Gold Southfield<\/a> operator carried out a Ransomware attack against a European company. The initial access is performed by Gold Cabin, an access broker, that deploys IceID<\/a> (Bokbot), a Remote Access Tool (RAT) malware[link<\/a>].<\/p>\n\n\n\n

Once inside the company, the access broker passes privileges to the main operator who deploys the REvil ransomware. This threat actor uses typical escalation techniques and moves laterally using CobaltStrike, Mimikatz, and other tools.<\/p>\n\n\n\n

In this article, we focus on the anomaly related to the time zone on the attacker\u2019s machine<\/strong>. Our information on the attack operations that were performed identifies cyber activity over roughly 10 days.<\/p>\n\n\n\n

In line with the times of the attack shared also by other cybersecurity groups [link<\/a>], we go ahead to investigating the actual times when the attack operations were performed, with surprising results. We are the first to identify that this piece of malware (csharp-streamer.exe<\/strong><\/em>) can be traced back to a Gold Southfield operator. Also, most surprisingly, despite REvil\u2019s mandate to work exclusively with Russian-speaking cybercriminals, we find that UTC time zone of the operations is UTC-8 (West Coast, US\/Canada).<\/p>\n\n\n\n

\n
\n

Table of Contents<\/p>\n<\/span><\/div>\n