Threat Group Profile
everest
● Active — last 30 days
Victim claims
33
First seen
Apr 2026
Last activity
20 Aug 2026
Tracked since
Sep 2021
Group overview
Everest ransom group collects and analyzes information about their victims. They specialize in customer privacy data, financial information, databases, credit card information, and more. The Everest ransom group leaks the victim's data to the darknet and they announced that any victim that will not contact them will suffer from a data leak and they will not delete hist files for future usage.
Preferred targets
Financial Services · 7
Business Services · 5
Healthcare · 4
Technology · 4
Transportation/Logistics · 2
Manufacturing · 2
Most targeted countries
US · 14
DE · 3
ES · 2
JP · 2
FR · 2
ID · 2
Tactics & techniques (MITRE ATT&CK)
Stealth
Obfuscated Files or Information
Obfuscated Files or Information: Dynamic API Resolution
Valid Accounts: Local Accounts
Modify Registry
Deobfuscate/Decode Files or Information
Execution Guardrails
Hide Artifacts
Debugger Evasion
Discovery
Remote System Discovery
Network Share Discovery
Software Discovery: Security Software Discovery
System Location Discovery: System Language Discovery
Lateral Movement
Remote Services: SMB/Windows Admin Shares
Command and Control
Application Layer Protocol: Web Protocols
Impact
Data Encrypted for Impact
Service Stop
Inhibit System Recovery