# Everest ransomware group

> As of 2026-10-23, Everest ransomware group is a North Korea (APT43/Kimsuky claim, unverified); Unknown (data brokers)-nexus threat actor tracked by Threadlinqs Intelligence across 2 threats spanning ransomware, data breach. Also known as Black Banshee, Earth Kumiho, Emerald Sleet, G0086. ATT&CK coverage spans 27 techniques across 12 tactics in 2 of 2 tracked threats. Most-observed techniques: T1078 (Valid Accounts), T1133 (External Remote Services), T1650 (Acquire Access).

- **Nation:** North Korea (APT43/Kimsuky claim, unverified); Unknown (data brokers)
- **Tracked threats:** 2
- **Categories:** RANSOMWARE, DATA_BREACH
- **Also known as:** Black Banshee, Earth Kumiho, Emerald Sleet, G0086, Operation Stolen Pencil, PatheticSlug, Sparkling Pisces, Springtail, TA427, THALLIUM, Velvet Chollima, Kimsuky
- **As of:** 2026-10-23

## ATT&CK techniques observed

27 techniques observed across 2 of 2 tracked threats. Tactics: Initial Access (5), Resource Development (4), Collection (3), Stealth (formerly Defense Evasion) (3), Command and Control (2), Credential Access (2).

- [T1078](https://intel.threadlinqs.com/technique/T1078) Valid Accounts — Initial Access — observed in 2 of 2 tracked threats
- [T1133](https://intel.threadlinqs.com/technique/T1133) External Remote Services — Initial Access — observed in 2 of 2 tracked threats
- [T1650](https://intel.threadlinqs.com/technique/T1650) Acquire Access — Resource Development — observed in 2 of 2 tracked threats
- [T1657](https://intel.threadlinqs.com/technique/T1657) Financial Theft — Impact — observed in 2 of 2 tracked threats
- [T1003.001](https://intel.threadlinqs.com/technique/T1003.001) OS Credential Dumping: LSASS Memory — Credential Access — observed in 1 of 2 tracked threats
- [T1003.003](https://intel.threadlinqs.com/technique/T1003.003) OS Credential Dumping: NTDS — Credential Access — observed in 1 of 2 tracked threats
- [T1014](https://intel.threadlinqs.com/technique/T1014) Rootkit — Stealth (formerly Defense Evasion) — observed in 1 of 2 tracked threats
- [T1021.001](https://intel.threadlinqs.com/technique/T1021.001) Remote Desktop Protocol — Lateral Movement — observed in 1 of 2 tracked threats
- [T1027](https://intel.threadlinqs.com/technique/T1027) Obfuscated Files or Information — Stealth (formerly Defense Evasion) — observed in 1 of 2 tracked threats
- [T1046](https://intel.threadlinqs.com/technique/T1046) Network Service Discovery — Discovery — observed in 1 of 2 tracked threats
- [T1048](https://intel.threadlinqs.com/technique/T1048) Exfiltration Over Alternative Protocol — Exfiltration — observed in 1 of 2 tracked threats
- [T1059](https://intel.threadlinqs.com/technique/T1059) Command and Scripting Interpreter — Execution — observed in 1 of 2 tracked threats
- [T1068](https://intel.threadlinqs.com/technique/T1068) Exploitation for Privilege Escalation — Privilege Escalation — observed in 1 of 2 tracked threats
- [T1070](https://intel.threadlinqs.com/technique/T1070) Indicator Removal — Stealth (formerly Defense Evasion) — observed in 1 of 2 tracked threats
- [T1119](https://intel.threadlinqs.com/technique/T1119) Automated Collection — Collection — observed in 1 of 2 tracked threats

## Tracked threats

- [Everest Ransomware Group Claims 590 GB PwC Data Theft (Unverified)](https://intel.threadlinqs.com/threat/TL-2026-4223) — MEDIUM
- [Dark Web Data-Leak Roundup (June 2026): Iran Hajj Organization (168M records), AdressFakta/SUPEReROI Sweden (5.4M+), Chrysler/Salesforce (1TB+, Everest Ransomware), and Crypto-Platform Lead Lists](https://intel.threadlinqs.com/threat/TL-2026-0803) — HIGH

## Full data

Infrastructure, IOC values and detection queries (Splunk SPL / Microsoft KQL / Sigma) require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/actor/Everest%20ransomware%20group