REvil Ransomware-as-a-Service: An analysis of a ransomware affiliate operation
intel471.com · Undated · Licence: not cleared; local research copy only
CVEs this report names
2 CVEs- CVE-2019-2725Oracle WebLogic Server, InjectionOracle · WebLogic ServerKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter4 reports>99.9%Top 0.02%88.8priority
- CVE-2018-8453Microsoft Win32k Privilege Escalation VulnerabilityMicrosoft · Win32kKEVRansomwarePublic exploitHigh · 7.8T1068Exploitation for Privilege Escalation1 report70.0%Top 0.62%82.2priority
Where it names them
CVE-2019-2725 Original (opens in a new tab) ↗
Deployments of REvil first were observed in April 2019, where attackers leveraged a vulnerability in Oracle WebLogic servers tracked as CVE-2019-2725.
CVE-2018-8453 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
Exploits a kernel privilege escalation vulnerability to gain SYSTEM privileges using CVE-2018-8453.
REvil ransomware exploits a kernel privilege escalation vulnerability in win32k.sys tracked as CVE-2018-8453 to gain SYSTEM privileges on the infected host.
The screenshot below shows the window name sysshadow and the application programming interface (API) DestroyWindow inside the embedded exploit, proving it is the CVE-2018-8453 vulnerability.
One technique relies on exploiting the CVE-2018-8453 vulnerability to gain SYSTEM privileges on the host.
The first JSON field checked is exp, which can be true or false and indicates whether the CVE-2018-8453 vulnerability should be exploited.
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.