Loading threat actor…
Everest, also known as Everest Group and Everest ransomware group, is a financially motivated, Russian-speaking cybercriminal operation active since at least December 2020. It combines ransomware, data-theft extortion and initial access brokerage, monetizing compromised environments through encryption, stolen information and the sale of access to other criminals. Its targets span healthcare, financial services, professional services, construction and government worldwide, with a recurring historical focus on U.S. medical-imaging providers. Russian-language activity does not establish a geographic base or Russian state sponsorship. Everest initially emphasized data exfiltration before expanding into ransomware. Access brokerage was observed by November 2021 and became more prominent in 2023. The operation has been characterized as ransomware-as-a-service and maintains a public leak site to pressure victims. Since at least October 2023, its operators have advertised payments for corporate access, including access to organizations in the United States, Canada and Europe. Such advertisements do not establish that employees cooperated with the group. Documented techniques include compromised-account access, remote services and RDP for access and lateral movement; credential dumping with ProcDump against LSASS; copying the Active Directory database; network discovery with SoftPerfect Network Scanner; and staging stolen information in WinRAR archives. Associated tooling includes Cobalt Strike, AnyDesk, Splashtop and Atera. Operators have deleted tools, discovery output and archives to conceal activity. Everest ransomware has been linked to the EverBe 2.0 lineage, and analyzed Windows encryptors attempt to weaken defenses and destroy recovery options. Everest increasingly emphasizes data theft and extortion without demonstrated encryption. In July 2026, it demanded approximately CHF 10 million from Stadler Rail after attackers used stolen credentials to access a supplier-shared data platform; Stadler reported that its own IT systems were not compromised. Everest's claimed theft volumes and victim listings do not independently establish the scope of a breach or ransomware deployment.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
37 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
2 malware families Mallory has associated with this actor across public reporting.
1 CVE Mallory has associated with this actor across public reporting. 1 of them is exploited in the wild (not necessarily by this actor).
4 indicators attributed to this actor. Values are masked here and available in full in Mallory.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.