Everest is a financially motivated ransomware and data extortion operation active since at least December 2020. It also sells access to compromised networks. The U.S. Department of Health and Human Services dates its observed initial access brokerage activity to November 2021 and describes increasing specialization in that business during 2023.
Everest’s public claims span several countries and industries, including construction and engineering, financial services, professional services, health care and government. HHS identified growing health sector exposure in its August 2024 profile, including medical imaging providers in the United States. These observations describe a historical sample of leak-site listings; they do not establish a fixed targeting policy or independently verify every claimed intrusion.
In July 2026, Picus Security described an operation combining ransomware deployment, access sales and advertisements seeking paid corporate insiders. HHS cautioned that advertisements seeking remote access can also involve other criminal access suppliers and do not necessarily establish successful insider recruitment.
NCC Group’s incident responders observed an intrusion involving Everest-branded ransomware in which the attackers used compromised accounts and Remote Desktop Protocol to move between systems, copied credential stores and installed remote access software. They used network scanners for discovery, WinRAR to prepare data, Cobalt Strike for command and control and Splashtop to transfer files. These are documented observations from an investigated intrusion, rather than a universal checklist for every Everest claim.
Picus described Windows ransomware that appends the .everest extension to encrypted files and removes shadow copies, restore points and backup files. The operation uses threatened disclosure of stolen information alongside encryption. A leak-site entry alone does not demonstrate that encryption or data theft occurred.
Picus describes Everest as Russian-speaking, but the reviewed evidence does not establish the operators’ identities, physical location or state sponsorship. NCC Group assessed a relationship between an analyzed Everest sample and BlackByte ransomware with medium confidence, while explicitly leaving unresolved whether code had been copied or the same operators were involved. That technical overlap is insufficient to treat the two actor names as aliases.
Breachsense lists Everest as claiming urologicspecialists.com, discovered Oct. 23, 2026. Original claim publication date and actor responsibility are unverified. KTUL separately reports lawsuit allegations of 200 GB stolen; Breachsense lists leak size unknown.
