Loading story…
The Everest ransomware group has publicly claimed responsibility for a significant breach of ASUS, a leading global hardware and electronics manufacturer. According to statements posted on a dark web leak site, Everest alleges it has stolen over 1TB of data from ASUS, including proprietary camera source code, firmware, and potentially other sensitive intellectual property. The group has demanded that ASUS contact them via the encrypted messaging platform Qtox within 21 hours, though no ransom amount has been disclosed. At this time, ASUS has not confirmed or denied the breach, and the exact nature and sensitivity of the compromised data remain unverified.
This incident follows a pattern of recent Everest ransomware claims against other high-profile organizations, such as Under Armour, Petrobras, and Iberia airline, which involved theft of user data and internal documentation. If substantiated, the breach would represent a major compromise for ASUS, which previously suffered the ShadowHammer supply chain attack in 2019. The situation underscores the ongoing threat posed by ransomware groups to major technology manufacturers and the potential for large-scale intellectual property theft and operational disruption.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
In connection with the ASUS-related leak, Everest also claimed to have stolen data from ArcSoft and Qualcomm, including source code, firmware, AI models, and other technical assets. This broadened the incident from a single-company breach claim to a wider supply-chain compromise allegation.
ASUS confirmed that a third-party supplier had been compromised after Everest published sample leaked data as proof of the intrusion. The company said the exposure involved some phone camera source code and stated that its products, internal systems, and user data were not affected.
The Everest ransomware group publicly claimed it had breached ASUS and stolen more than 1 TB of data, including proprietary camera source code and firmware. The group demanded that ASUS respond via Qtox within 21 hours, but no ransom amount was disclosed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
go.theregister.com
Open sourcesecurityaffairs.com
Open sourcescworld.com
Open sourcehackread.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Under Armour** customer data tied to an **Everest** ransomware intrusion was added to *Have I Been Pwned*, including **~72 million email addresses** and additional fields such as names, birthdates, gender, purchase details, and location information. Reporting notes Everest previously claimed theft of **343 GB** from Under Armour and threatened public release if negotiations did not occur; commentary also highlighted the downstream risk of exposed data enabling targeted phishing and social engineering, and described Everest as expanding beyond encryption into **initial access brokering** using remote access tools and weak credentials. Separately, **Nike** was listed by the **WorldLeaks** ransomware/extortion group on its darknet leak site, with the actor claiming data exfiltration and threatening to publish stolen data. Nike publicly stated it is **investigating a potential cybersecurity incident**, while the attacker’s post provided limited verifiable detail and the total volume of data remains unconfirmed; the report alleged exposure could include internal documentation and customer/employee information, and described WorldLeaks as an **extortion-only** rebrand of *Hunters International* focused on data theft rather than file encryption.
Jun 29, 2026
The **Everest ransomware group** claimed it breached **Nissan Motor Corporation** and stole data, posting alleged proof on its dark web leak site. The actors shared **six screenshots** and a directory listing that appear to show internal file storage and records, including documents and data extracts in formats such as `.csv`, `.txt`, and `.xls` (with additional file types like `.pgp` referenced). The material shown includes references to dealership information, certification reports, and claims processing; one screenshot reportedly shows a spreadsheet with dealership names and locations. Everest issued Nissan a **five-day ultimatum** to respond, threatening to publish the allegedly stolen data if the company does not engage. The screenshots do not visibly expose sensitive personal data, but the folder names and file types suggest access to operational systems and internal documentation that could enable further exploitation or data mining. Reporting also contextualized the claim against Nissan’s prior exposure to ransomware activity, including a 2025 claim by **Qilin** involving a Nissan-related entity, underscoring continued targeting of large automotive organizations by extortion-focused groups.
Jun 29, 2026
Everest ransomware group claimed responsibility for breaching Petrobras, Brazil's state-owned oil and gas giant, and exfiltrating over 90 GB of sensitive seismic navigation data. The stolen files reportedly include detailed technical information such as ship positioning, equipment configurations, hydrophone readings, depth measurements, and quality control documents related to Petrobras' seismic surveys, particularly in the Campos Basin. Screenshots of the stolen data were published by the threat actors to substantiate their claims, and the data is said to include both 3D and 4D survey datasets, which are critical for oil exploration and production. The breach poses a significant reputational risk to Petrobras and could undermine its competitive advantage, as the exposed data may allow competitors to replicate Petrobras' methods or gain leverage in contract negotiations. While the data does not appear to include real-time corporate access, the leak of such proprietary research and technical documentation could have long-term strategic implications for Petrobras. Everest's claims follow a pattern of targeting major industrial and energy sector organizations worldwide.
Jun 29, 2026