Ransomware Intelligence / Groups / everest

Ransomware group

everest

Everest is a ransomware group active since at least December 2020, known for its double-extortion tactics. The group initially operated as a typical ransomware outfit, encrypting files with strong cryptography and appending victim-specific extensions, but later shifted toward pure data extortion—threatening to sell or release stolen data without necessarily deploying encryption. Everest targets a wide range of sectors, including government, healthcare, manufacturing, and IT services, with confirmed victims in North America, Europe, and Asia. Initial access vectors include exploitation of vulnerable public-facing applications, phishing campaigns, and credential theft for remote access services. The group maintains a Tor-based leak site to publish stolen information and advertise access to compromised networks.

• 0claims, 7 days
• 21claims, 30 days
• 47claims, 90 days
• 2026-04-01first seen
• 2026-10-27last seen

These are claims posted by the group on its leak site, counted when we first see them. They are not confirmed incidents, and we never name a victim.