Loading malware…
Everest is a Russian-speaking ransomware operation active since at least late 2020 and commonly described as a ransomware-as-a-service or affiliate-driven extortion group. It has been associated with double extortion, combining data theft with file encryption and threats to publish stolen information, and later evolved toward encryptionless extortion focused primarily on data theft and coercive disclosure. Reporting also links Everest to initial access brokering, including reselling network access to other threat actors and at times leveraging data obtained through third-party compromises or other actors’ intrusions.
Everest has targeted organizations across multiple sectors, including government, healthcare, telecommunications, transportation, aviation, manufacturing, finance, and technology, with victims reported in North America, Europe, and Asia. Observed intrusion vectors include exploitation of vulnerable public-facing applications, phishing, and use of stolen or compromised credentials. In some incidents, access was obtained through suppliers or shared third-party platforms rather than direct compromise of the victim’s internal environment.
Technical analysis of the Everest encryptor shows a Windows .NET ransomware payload protected with ConfuserEx and designed primarily for defense evasion and encryption rather than built-in exfiltration. The malware performs mutex-based execution control, terminates selected processes, disables security protections, deletes shadow copies, removes backup-related artifacts, and avoids execution on systems configured for Commonwealth of Independent States locales. It encrypts files using AES with RSA-protected keys, can partially encrypt larger files for speed, drops ransom notes, and self-deletes after execution. An unusual observed behavior is use of Wake-on-LAN to wake sleeping hosts so they can also be encrypted. Analysis indicates that when data theft occurs, it is likely conducted earlier in the intrusion with separate tooling rather than by the ransomware binary itself.
Everest has remained notable not only for ransomware deployment but also for extortion operations centered on stolen data, public leak-site pressure, and opportunistic use of third-party breaches. Its infrastructure has experienced disruptions, including leak-site outages and defacement, but the group has continued to reappear under new infrastructure.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
"This latest blog documents the TTPs employed by a group who were observed deploying Everest ransomware during a recent incident response engagement."
"This latest blog documents the TTPs employed by a group who were observed deploying Everest ransomware during a recent incident response engagement."
21 distinct techniques documented for this family, organized by ATT&CK tactic.
Its usual playbook involves exploiting vulnerable public facing applications, phishing campaigns, and abusing stolen credentials to gain remote access.
The encryptor itself is a .NET executable protected with ConfuserEx, a tool that strips identifying watermarks and adds anti tampering layers before analysis begins.
From there, the malware disables Windows Defender’s Controlled Folder Access, deletes shadow copies, wipes backup related files... The ransomware wraps up by dropping a note called EVERESTRANSOMWARE.txt into every affected folder and on the desktop, before triggering a delayed self deletion routine to erase its own tracks.
One of the more unusual traits AttackIQ flagged is the ransomware’s use of Wake on LAN broadcasts, sent to force sleeping machines on the network to power up so they too can be encrypted.
Security teams should expand emulation coverage to include Wake on LAN broadcasts, mapped drive enumeration, and active network connection discovery, since these behaviors reflect genuine attacker movement rather than isolated test conditions.
"The group alleges it obtained approximately 90GB of internal data... the data is described as a database and internal company documentation."
"Everest Ransomware Says It Breached Brazilian Energy Giant Petrobras" / "demanding contact through qTox"
Despite boasting about stealing a full terabyte of data from a victim organization, the actual malware sample used in the intrusion contains no code capable of exfiltrating anything at all.
In the aftermath of the Colonial Pipeline ransomware attack, the underground cybercrime ecosystem is reshuffling... The first to go was Darkside, the ransomware gang that orchestrated the Colonial Pipeline attack.
4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
56 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Everest is a Russian-speaking cybercrime group operating since around December 2020 that conducts ransomware and extortion activity. In this incident, it allegedly accessed technical data via a supplier platform using compromised credentials and attempted to extort Stadler Rail. The content also notes Everest has used both encryptionless extortion and double extortion, and has expanded into initial access brokering and recruiting corporate insiders.
Everest is described as a ransomware operation active since 2020 that shifted from network encryption to data theft and extortion. The group has also operated as an initial access broker and has used stolen data to conduct extortion campaigns.
Everest is described as a threat group that emerged in 2020 as a ransomware operation but later abandoned network encryption in favor of data theft and extortion, threatening victims with leaking stolen data unless a ransom is paid. The group has also acted as an initial access broker by selling network access to other threat actors.
Double-extortion ransomware active since at least December 2020. It encrypts files, drops an EVERESTRANSOMWARE.txt note, appends a .everest extension, disables defenses, deletes shadow copies and backup-related files, removes Raccine, uses Wake-on-LAN to wake sleeping hosts for broader encryption, and self-deletes after execution. The analyzed sample contained no data-exfiltration capability, suggesting any theft occurred earlier in the intrusion via separate tools.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.