Everest Ransomware: Threat Profile, Attack Lifecycle, and Response Guide

Everest is a financially motivated ransomware and cyber extortion group active since at least December 2020. It has combined ransomware deployment, data-leak extortion, initial access brokerage, and direct insider recruitment into a single, adaptable criminal operation that has proven resilient to infrastructure disruptions.

The group has compromised, or claimed attacks on, organizations across technology, healthcare, aerospace, aviation, and critical infrastructure, with victims spanning North America, Europe, Asia, the Middle East, and Latin America. Since 2025, Everest has mostly stolen data without encrypting it, often by logging in to a file-transfer or file-sharing system, sometimes a supplier's.

Updated October 2026: Everest remains active and has listed more than 130 organizations on its leak site in 2026.

Origins and evolution of Everest ransomware

Everest started as a data-theft operation, sold network access from late 2021, added encryption by 2022, and began recruiting insiders in 2023.

How Everest started: Exfiltration-only origins

Everest emerged in December 2020 as a data theft and extortion operation. Early campaigns focused on network compromise, data exfiltration, and leak-site publication without deploying file-encrypting malware. The group's first claimed victims were mostly Canadian companies, with others in the U.S. and India.

Initial access brokerage

From around November 2021, Everest also worked as an initial access broker (IAB), selling footholds in compromised networks to other criminals instead of running every intrusion itself. In mid-2023, researchers documented a significant rise in the group's IAB activity.

For defenders, this means the next attack on a network Everest has breached may come from another group.

Everest ransomware evolves into double extortion

By 2022, Everest had added encryption to its operations, adopting the double extortion model that had become standard across the ransomware ecosystem. The group's encryptor used AES-128 and RSA-1024 and generated keys locally on victim hosts rather than receiving them from a command-and-control server.

A 2022 analysis links an Everest ransomware sample to the BlackByte ransomware family with medium confidence. The analysis could not determine whether another group copied BlackByte's code or whether BlackByte itself produced the sample. Earlier reports also tied Everest to EverBe 2.0, but no published code analysis supports that link.

Recent strategy: Insider recruitment and data-only extortion

In June 2023, Everest began advertising on its own leak site for partners with access to corporate networks, which the press read as recruiting insiders; by October, it was seeking RDP, VPN, TeamViewer, or AnyDesk access to companies in the U.S., Canada, and Europe. In return, it promised "a good percentage" of the profits from successful attacks.

A recruited insider can pass multi-factor authentication, so detection must focus on how legitimate accounts behave.

The group has largely moved to data-only extortion. This mirrors a wider shift in ransomware extortion: organizations generally cope better with encrypted data than with leaked data.

In 2025, Everest's dark web leak site was defaced with the message "Don't do crime CRIME IS BAD xoxo from Prague." Who was behind it is still unknown. Despite the disruption, the group continued operations.

Everest ransomware attack lifecycle

Since 2025, publicly reported Everest attacks have mostly stopped at data theft. The full attack chain below comes largely from a single 2022 intrusion and the 2022 encryptor sample.

Phase 1: Initial access

Early reporting tied Everest's initial access to exposed remote services. More recently, several victims have confirmed that attackers logged in with valid credentials to a file-transfer or file-sharing system, sometimes a supplier's.

Other reported vectors include purchased access from brokers, phishing, exploitation of unpatched systems, and insider-provided access.

Phase 2: Reconnaissance and credential access

Once inside, operators map the network and identify file shares, mainly with SoftPerfect Network Scanner. Credential harvesting has involved dumping LSASS memory with ProcDump and copying NTDS.dit.

Phase 3: Lateral movement

Everest relies heavily on legitimate administrative tools to blend with normal enterprise activity, a practice known as living off the land. Operators control compromised hosts through Cobalt Strike beacons launched with PowerShell, move between systems over RDP, and install the AnyDesk, Splashtop, and Atera remote-access tools as services to maintain access.

According to Proven Data expert Amr Fathy, WMI and PowerShell are the most common lateral movement tools in ransomware attacks. The attackers' commands look identical to those sysadmins run. "We differentiate by context: which account, which time, which source, which child processes. WMI spawning certutil, for example," he explains.

Phase 4: Data exfiltration

Data exfiltration precedes encryption in Everest intrusions, and in data-only attacks, no encryption follows. Targeted data includes PII, PHI, financial records, legal documents, internal communications, intellectual property, and customer databases. Operators install WinRAR on file servers to archive data, then exfiltrate it over Splashtop's file-transfer feature. When the entry point is a file-transfer or file-sharing system, the data is downloaded directly from it.

Phase 5: Impact

When deployed, the 2022 encryptor stops security, backup, and database services (including Veeam, Acronis, and SQL Server). Next, it deletes shadow copies, restore points, and local backup files, then encrypts local drives and reachable network shares. It appends .everest to encrypted files and drops EVERESTRANSOMWARE.txt as the ransom note.

Whether or not files are encrypted, victims face leak-site publication, countdown timers of 24 hours to about a week, incremental sample data releases, and occasional offers to sell the data.

Defense evasion

In the 2022 intrusion, operators routinely deleted their tools, reconnaissance output, and archives of collected data from compromised hosts, making the attack chain harder to reconstruct.

The 2022 encryptor disables Microsoft Defender's Controlled Folder Access, removes the Raccine anti-ransomware tool, kills debuggers and analysis tools, and changes its own process permissions so utilities like taskkill cannot stop it. When it finishes, it overwrites its own file with zeros and deletes it.

Everest ransomware targets

Since 2025, most victims on Everest's leak site have come from these sectors:

Healthcare has its own U.S. government profile of Everest: the Health Sector Cybersecurity Coordination Center (HC3) at the Department of Health and Human Services published it in August 2024. It counted nearly 20 healthcare incidents and found that the group disproportionately targeted U.S. medical imaging providers.

Organizations in the sector can assess their exposure and find relevant controls and preparedness steps in Proven Data's healthcare cybersecurity guide.

Confirmed and claimed incidents

The following incidents have been attributed to or claimed by Everest. Five of the organizations below confirmed an incident, and each pointed to a supplier or an external file-transfer or file-sharing system as the source of the data. Liberty Mutual, Under Armour, and Collins Aerospace have not confirmed Everest's claims.

PwC (October 2026)

Everest claimed theft of 590 GB of employee data; PwC confirmed an incident at a supplier that hosts employee learning records, saying the supplier's site held no client data, sensitive personal data, or financial information, and PwC's own network was not affected. Everest has since listed pwc.com among its published databases.

Stadler Rail (July 2026)

Everest demanded CHF 10 million (about $12.3 million) in a letter before any leak-site post; Stadler said that attackers used compromised credentials to take a supplier's technical documents from a data exchange platform, that its own systems were not affected, and that it would not pay.

Liberty Mutual (May 2026)

Everest began leaking purported Liberty Mutual data, 108 GB that it claimed contained policyholder names, addresses, policy numbers, and financial and insurance details. The insurer said its review found no compromise of its own systems and that the incident appeared to involve a supplier.

Iron Mountain (February 2026)

Everest claimed theft of 1.4 TB, including internal documents and client information. The company said one compromised credential exposed a single folder of mostly marketing materials shared with vendors on a public file-sharing site, with no ransomware involved.

Under Armour (November 2025)

Everest claimed it stole 343 GB, including employee and customer PII, internal documents, and order histories. Later, Have I Been Pwned added 72.7 million email addresses from the leak. Under Armour said it had no evidence that UA.com or its payment systems were affected.

Svenska kraftnät, Sweden's grid operator (October 2025)

Everest claimed theft of about 280 GB of internal data; the operator confirmed a breach of a limited external file-transfer system without naming Everest and said the power supply was not affected.

Collins Aerospace and Dublin Airport (October 2025)

Everest claimed it stole passenger and airline staff data from a Collins FTP server, reportedly using a login harvested by an infostealer in 2022 and unchanged since. Collins has not commented on the claim. Some reports tie Everest to the earlier ransomware outage of Collins' MUSE check-in software, but RTX, Collins' parent company, has not named the group behind it. Everest says it has not used ransomware in years.

Everest later claimed theft of 1.5 million records, including passenger data, from Dublin Airport. The airport operator, daa, confirmed that boarding data for August 2025 departures was compromised at its supplier Collins Aerospace, without naming Everest or giving a number.

MITRE ATT&CK

The techniques below are mapped to MITRE ATT&CK v20, where the former Defense Evasion tactic is split into Stealth and Defense Impairment. The table lists only techniques documented in a specific incident or sample. All come from a single 2022 intrusion or the 2022 encryptor sample; in 2025-2026 cases, Valid Accounts (T1078) is also the entry point.

Indicators of compromise

Use the indicators below to detect and hunt for Everest activity.

Hands-on activity

• Unusual logins followed by bulk or intermittent downloads from internet-facing file-transfer or file-sharing systems, including those run by suppliers
• SoftPerfect Network Scanner (netscan.exe, svcdsl.exe) launched from non-IT accounts, and scan output files such as subnets.txt and trustdumps.txt
• Unexpected ProcDump execution, direct LSASS process access, or copies of NTDS.dit
• Cobalt Strike beacons launched with powershell.exe -nop -w hidden -c IEX download cradles, and a Metasploit payload named l.exe
• AnyDesk, Splashtop, or Atera newly installed as Windows services, or large file transfers through Splashtop
• WinRAR installed or run on file servers outside IT workflows

Encryptor artifacts (2022 sample)

Ransom note

The note below comes from the same sample and was written for a single victim.

After a greeting and links to its leak site, the note claims that Everest stole more than 1 TB of internal files and can prove it:

"Also, our team was able to bypass your "Dataprotection" as any other your protection software and more than 1 Terabyte of internal files were exfiltrated to our servers, which we can confirm with great joy and ease"

It then lists the stolen data and, if the victim pays, offers an "attack logbook" with the vulnerabilities used, deletion of the files, and a promise not to attack again.

Treat these claims as unverified until a forensic investigation, ideally by an experienced DFIR team, confirms what was actually taken.

Responding to an Everest ransomware attack

Proven Data's guide on how to handle a ransomware attack covers the broader response framework. The priorities below are specific to Everest; the first two apply to every case, including data-only ones.

• Check file-transfer systems and suppliers. Several recent Everest cases began with a login to a file-transfer or file-sharing system, sometimes one a supplier runs; reset that system's credentials and review months of its logs to scope what was taken.
• Monitor the leak site and assess disclosure duties. Watch for sample releases and sale offers; if PHI was taken, check HIPAA notification obligations.
• Isolate hosts that are still encrypting, but do not shut them down. The 2022 encryptor keeps its AES key in process memory until it exits, so a full memory image taken first could allow decryption of that run's files, though no public case has shown it.
• Keep the ransom notes and the PublicKey registry value. Both hold the encrypted key seed; the registry value is at HKCU\Software\AppName\PublicKey, in the hive of the account that ran the encryptor. No public decryptor exists. Without a memory image, decryption requires the attackers' private key to unlock the seed, so it also needs the note or the registry value.
• Remove the attackers' remote access. End VPN and RDP sessions for compromised accounts, and look for AnyDesk, Splashtop, or Atera installed as services, as well as Cobalt Strike beacons.
• If attackers compromised a domain controller, reset every domain credential. Everest operators have copied NTDS.dit, which holds every domain account's password hash; include service accounts and reset krbtgt twice, at least one maximum ticket lifetime apart (10 hours by default).
• Rebuild the hosts the encryptor ran on. The encryptor grants Everyone full control over files and enables SMBv1. Restore only from backups the attackers could not reach, and validate Active Directory backups first.

Fathy notes that attackers embed persistence where teams do not check during recovery: a weekly task that re-downloads a beacon, or a modified GPO that pushes malicious logon scripts. "We've seen clients recover successfully and get re-compromised within 48 hours from a poisoned GPO in their restored Active Directory backup."

Organizations requiring structured DFIR support or pre-incident preparedness can engage Proven Data's Incident Response Retainer for pre-negotiated access to response capabilities.

Strategic assessment

For security teams, incident responders, and MSPs, the current Everest threat starts with identity, not malware. Rotating and monitoring the accounts on internet-facing file-transfer and file-sharing systems, and watching for unusual downloads, matter as much as endpoint detection.

Several victims said the data came from a supplier's systems, not their own. Knowing which suppliers hold your data and how they control access to it is just as important.