Everest Ransomware: Triple Extortion via Encryption, Access Brokering, and Insider Recruitment — Threadlinqs Intelligence
As of 2026-07-10, Everest Ransomware: Triple Extortion via Encryption, Access Brokering, and Insider Recruitment is a high-severity ransomware threat attributed to Everest, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 29 indicators of compromise.
Threat ID: TL-2026-1172 · Severity: HIGH · Status: ACTIVE · Category: RANSOMWARE
Attribution: Everest · FINANCIAL
Everest is a Russian-speaking, closed-group Windows ransomware-as-a-service operation (.everest extension) active since December 2020, running three parallel revenue streams: double-extortion
Everest emerged in December 2020 as a data-exfiltration-focused operation targeting Canadian organizations before transitioning to full double-extortion ransomware with AES/DES encryption in early 2021. After a voluntary leak-site takedown around a law-enforcement crackdown in May 2021, the group pivoted in November 2021 to initial access brokering (IAB), selling compromised network access and stolen credentials to other threat actors. In October 2023 it launched a paid corporate insider recruitment program, offering cash payments and profit-sharing on dark web forums to employees willing to provide direct remote access to their employers' networks in the US, Canada, and Europe. From 2024 onward the group has increasingly shifted toward data-only extortion without deploying encryption at all, while continuing to run encryption-based double extortion against other victims.
Technically, Everest's ransomware payload is a ConfuserEx-1.x-obfuscated .NET/C# binary (UPX-packed in some native builds) that generates a 32-character random seed, derives an AES-128-CBC key and IV via Rfc2898DeriveBytes/PBKDF2 (1000 iterations), and wraps the seed with an embedded RSA-1024 public key -- despite the code internally declaring AES-256/RSA-4096 before silently downgrading at runtime. Encryption keys are generated locally on the compromised host rather than fetched from C2, a technique researchers have linked with medium-high confidence to the BlackByte ransomware family's C# variant (as opposed to BlackByte's original Go-based lineage); Everest is also linked to the EverBe 2.0 ransomware family lineage. Files under 10MB are fully encrypted, overwritten, and deleted; larger files receive in-place partial encryption across six non-contiguous regions.
Pre-encryption, the malware creates a unique mutex, performs CIS-locale geo-fencing checks to avoid post-Soviet-state victims (consistent with its Russian-speaking operator base), enables SeDebugPrivilege via AdjustTokenPrivileges, and runs three background monitoring threads. It methodically dismantles defenses: disabling Controlled Folder Access, modifying LocalAccountTokenFilterPolicy and EnableLinkedConnections registry values to weaken remote UAC token filtering, re-enabling SMBv1/NTLM and long file paths via registry, granting world-writable ACLs (icacls C:\* /grant Everyone:F /T /C /Q), removing the Raccine anti-ransomware tool via IFEO hooks/registry/scheduled-task cleanup, and mutating its own process security descriptor to resist taskkill. It terminates a broad target list of debuggers (x64dbg, IDA, DnSpy, ILSpy), network analyzers (Wireshark, Fiddler, TCPDump), endpoint protection (McAfee, Kaspersky, Sophos, ESET) and backup software (Veeam, Acronis, Zoolz) via Restart Manager (RmStartSession/RmShutdown) sequences, then deletes volume shadow copies and sabotages recovery options.
Network reconnaissance uses SoftPerfect Network Scanner (netscan.exe/netscanpack.exe), net view, NetDfsEnum/WNetEnumResource, and ARP-cache parsing, writing results to subnets.txt and trustdumps.txt under C:\Users\Public\Downloads. Lateral movement includes Wake-on-LAN magic-packet broadcasts (UDP ports 7/9) to wake dormant hosts and SMB/RDP-based remote services. Operators deploy Cobalt Strike as primary C2 over HTTPS, harvest LSASS memory and NTDS.dit via ProcDump, and install AnyDesk, Splashtop, and Atera as persistent Windows services for remote access -- with Splashtop's file-transfer feature used to exfiltrate archived (WinRAR) data before encryption. The group is noted for near-complete tool deletion after each operational stage, leaving fewer forensic artifacts than many peer RaaS operations. Victims are extorted via a Tor-based leak site with countdown timers and staged data releases, communications via Jabber/XMPP, onionmail, and Tox, with Monero preferred over Bitcoin for payment (BTC incurs a traceability premium). Initial access vectors are exposed RDP without MFA, vulnerable VPN endpoints, purcha
Target sectors: health, financial-services, legal, construction, government administration, manufacturing, technology, retail, aviation, energy, utilities
Target regions: North America, Europe, Middle East
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 29 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
RANSOMWARE, HIGH, threat intelligence, cybersecurity, T1133, T1078, T1199, T1190, T1566, T1059, T1059, T1204, T1543, T1547