Everest Ransomware: Triple Extortion via Encryption, Access Brokering, and Insider Recruitment
Everest Ransomware (TL-2026-1172) is a high-severity ransomware operation, first published 2026-07-10. It is attributed to Everest with medium confidence, affects Microsoft Windows environments with internet-exposed RDP/VPN or weak, maps to 39 MITRE ATT&CK techniques (T1003, T1018, T1021), and is covered by 9 detection rules and 29 indicators of compromise.
Key facts for TL-2026-1172
- Threat ID
- TL-2026-1172
- Severity
- HIGH
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- 2026-07-10
- Last reviewed
- 2026-07-10
- Attribution
- Everest
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- health, financial-services, legal, construction, government administration, manufacturing, technology, retail, aviation, energy, utilities
- Target regions
- North America, Europe, Middle East
- Detection rules
- 9
- Indicators of compromise
- 29
Malware and tooling in Everest Ransomware
Malware and tooling: BlackByte, Everest, AnyDesk, Atera, Cobalt Strike, ProcDump, SoftPerfect Network Scanner (netscan.exe / netscanpack.exe), Splashtop, WinRAR
Everest is a Russian-speaking, closed-group Windows ransomware-as-a-service operation (.everest extension) active since December 2020, running three parallel revenue streams: double-extortion ransomware deployment, initial access brokering (since November 2021), and paid corporate insider recruitment (since October 2023). Technically linked to BlackByte ransomware via locally-generated AES keys, it has expanded from healthcare/financial/legal/construction/government/manufacturing/aviation/energy targets into claimed attacks on critical infrastructure (national power grids, airports, telecoms) through 2025-2026.
How Everest Ransomware works
Everest emerged in December 2020 as a data-exfiltration-focused operation targeting Canadian organizations before transitioning to full double-extortion ransomware with AES/DES encryption in early 2021. After a voluntary leak-site takedown around a law-enforcement crackdown in May 2021, the group pivoted in November 2021 to initial access brokering (IAB), selling compromised network access and stolen credentials to other threat actors. In October 2023 it launched a paid corporate insider recruitment program, offering cash payments and profit-sharing on dark web forums to employees willing to provide direct remote access to their employers' networks in the US, Canada, and Europe. From 2024 onward the group has increasingly shifted toward data-only extortion without deploying encryption at all, while continuing to run encryption-based double extortion against other victims.
Technically, Everest's ransomware payload is a ConfuserEx-1.x-obfuscated .NET/C# binary (UPX-packed in some native builds) that generates a 32-character random seed, derives an AES-128-CBC key and IV via Rfc2898DeriveBytes/PBKDF2 (1000 iterations), and wraps the seed with an embedded RSA-1024 public key -- despite the code internally declaring AES-256/RSA-4096 before silently downgrading at runtime. Encryption keys are generated locally on the compromised host rather than fetched from C2, a technique researchers have linked with medium-high confidence to the BlackByte ransomware family's C# variant (as opposed to BlackByte's original Go-based lineage); Everest is also linked to the EverBe 2.0 ransomware family lineage. Files under 10MB are fully encrypted, overwritten, and deleted; larger files receive in-place partial encryption across six non-contiguous regions.
Pre-encryption, the malware creates a unique mutex, performs CIS-locale geo-fencing checks to avoid post-Soviet-state victims (consistent with its Russian-speaking operator base), enables SeDebugPrivilege via AdjustTokenPrivileges, and runs three background monitoring threads. It methodically dismantles defenses: disabling Controlled Folder Access, modifying LocalAccountTokenFilterPolicy and EnableLinkedConnections registry values to weaken remote UAC token filtering, re-enabling SMBv1/NTLM and long file paths via registry, granting world-writable ACLs (icacls C:\* /grant Everyone:F /T /C /Q), removing the Raccine anti-ransomware tool via IFEO hooks/registry/scheduled-task cleanup, and mutating its own process security descriptor to resist taskkill. It terminates a broad target list of debuggers (x64dbg, IDA, DnSpy, ILSpy), network analyzers (Wireshark, Fiddler, TCPDump), endpoint protection (McAfee, Kaspersky, Sophos, ESET) and backup software (Veeam, Acronis, Zoolz) via Restart Manager (RmStartSession/RmShutdown) sequences, then deletes volume shadow copies and sabotages recovery options.
Network reconnaissance uses SoftPerfect Network Scanner (netscan.exe/netscanpack.exe), net view, NetDfsEnum/WNetEnumResource, and ARP-cache parsing, writing results to subnets.txt and trustdumps.txt under C:\Users\Public\Downloads. Lateral movement includes Wake-on-LAN magic-packet broadcasts (UDP ports 7/9) to wake dormant hosts and SMB/RDP-based remote services. Operators deploy Cobalt Strike as primary C2 over HTTPS, harvest LSASS memory and NTDS.dit via ProcDump, and install AnyDesk, Splashtop, and Atera as persistent Windows services for remote access -- with Splashtop's file-transfer feature used to exfiltrate archived (WinRAR) data before encryption. The group is noted for near-complete tool deletion after each operational stage, leaving fewer forensic artifacts than many peer RaaS operations. Victims are extorted via a Tor-based leak site with countdown timers and staged data releases, communications via Jabber/XMPP, onionmail, and Tox, with Monero preferred over Bitcoin for payment (BTC incurs a traceability premium). Initial access vectors are exposed RDP without MFA, vulnerable VPN endpoints, purchased/stuffed credentials, phishing, unpatched public-facing applications, and the insider-recruitment channel -- no CVE-based exploitation has been documented; the group relies entirely on misconfiguration and social/insider vectors.
Activity has escalated through 2025-2026: an April 2025 leak-site defacement ('Don't do crime CRIME IS BAD xoxo from Prague', speculatively attributed to rival group DragonForce) was followed by recovery and a July-October 2025 period described as the group's most active since inception, including claimed attacks on Heathrow/Brussels/Berlin airport systems (September 2025) and Swedish national power-grid/telecom infrastructure (October 2025). Confirmed/claimed named victims span MCNA Dental (1M+ EMRs, Nov 2024), Mitsubishi Chemical (6TB, Aug 2024), Collins Aerospace/RTX (Oct 2025), Under Armour, Petrobras, STIIIZY (422,075 customer records), Coca-Cola, Nissan, Fiserv, Liberty Mutual, TransferZ, L&P Aesthetics, and Rehab Clinics Group.
MITRE ATT&CK techniques used in TL-2026-1172
Credential Access
Discovery
T1018 Remote System Discovery; T1040 Network Sniffing; T1046 Network Service Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1087 Account Discovery; T1135 Network Share Discovery; T1538 Cloud Service Dashboard; T1580 Cloud Infrastructure Discovery; T1615 Group Policy Discovery
Lateral Movement
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Defense Evasion
T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion; T1564 Hide Artifacts
Command and Control
T1071 Application Layer Protocol; T1219 Remote Access Tools
Initial Access
T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1199 Trusted Relationship; T1566 Phishing
defense-impairment
T1112 Modify Registry; T1222 File and Directory Permissions Modification; T1685 Disable or Modify Tools
Impact
T1485 Data Destruction; T1486 Data Encrypted for Impact; T1490 Inhibit System Recovery; T1529 System Shutdown/Reboot; T1531 Account Access Removal
Persistence
T1543 Create or Modify System Process; T1547 Boot or Logon Autostart Execution
Privilege Escalation
T1548 Abuse Elevation Control Mechanism
Collection
Affected products and versions in Everest Ransomware
- Microsoft — Windows environments with internet-exposed RDP/VPN or weak remote-access authentication
Vulnerable versions: Not version-specific -- misconfiguration/credential-based access, not a software vulnerability
Fixed in: N/A
Remediation for Everest Ransomware
Immediate actions
- Enforce MFA on all RDP and VPN remote-access endpoints; disable direct internet exposure of RDP (TCP 3389)
- Alert on Controlled Folder Access being disabled, SMBv1/NTLM re-enablement, or LongPathsEnabled/LocalAccountTokenFilterPolicy/EnableLinkedConnections registry changes
- Monitor for Raccine or other anti-ransomware tool removal via registry, IFEO hooks, or scheduled task deletion
- Detect and block SoftPerfect Network Scanner (netscan.exe/netscanpack.exe), ProcDump against lsass.exe, and mass icacls Everyone:F grants
- Alert on Restart Manager (RmStartSession/RmShutdown) mass process-termination sequences targeting security/backup tools
- Detect Wake-on-LAN magic packet floods (UDP 7/9) originating from workstations rather than management infrastructure
Workarounds
- No CVE-based exploitation is documented; Everest relies on misconfiguration (exposed RDP/VPN, weak/purchased credentials, insider access) rather than software vulnerabilities, so hardening remote-access configuration is the primary mitigation
Longer-term hardening
- Deploy EDR with behavioral detection tuned to the pre-encryption noisy sequence (defense-tampering, backup sabotage, permission grants) rather than relying on signature-based AV alone
- Implement immutable/offline backups resistant to vssadmin shadow-copy deletion and administrator-level tampering
- Establish insider-threat monitoring and reporting channels given Everest's active paid-insider-recruitment revenue stream
- Segment networks to limit SMB admin-share and RDP lateral movement between business units
- Restrict and monitor RMM tool installation (AnyDesk, Splashtop, Atera) as Windows services; allowlist approved remote-access software only
Timeline of Everest Ransomware
- Everest emerges as a data-exfiltration-focused extortion operation targeting Canadian organizations.
- Everest voluntarily takes down its leak site amid a law-enforcement crackdown period.
- Group pivots into initial access brokering (IAB), selling compromised network access and credentials to other threat actors.
- Everest issues a joint victim announcement with the Ransomed ransomware group.
- Everest launches a paid corporate insider recruitment program on dark web forums, offering cash and profit-sharing for employee-provided remote access across US, Canada, and Europe.
- Mitsubishi Chemical claimed as a victim with roughly 6TB of exfiltrated data.
- MCNA Dental claimed as a victim with over 1 million exfiltrated electronic medical records.
- Everest's Tor leak site is defaced with the message 'Don't do crime CRIME IS BAD xoxo from Prague,' speculatively attributed to rival group DragonForce; operations recover by mid-2025.
- Coca-Cola claimed as a victim on the Everest leak site.
- Everest claims attacks affecting Heathrow, Brussels, and Berlin airport systems (unverified by third parties).
- Everest claims attacks on Swedish national power-grid and telecommunications infrastructure; July-October 2025 marks the group's most active period since inception, per Halcyon.
- Collins Aerospace/RTX claimed as a victim.
- Nissan and Liberty Mutual Insurance claimed as victims.
- Rehab Clinics Group Ltd (UK healthcare) claimed as a victim.
- TransferZ (Netherlands transportation) and L&P Aesthetics (California healthcare) claimed as victims on the same date.
Sources cited for Everest Ransomware
- Everest Ransomware: Triple Threat of Encryption, Access, and Insiders
- Everest (threat group profile)
- Alert: Everest Group Targeting Critical Infrastructure
- Everest (group technical profile / IOCs)
- Everest Ransomware
- Climbing Mount Everest: Black-Byte Bytes Back?
- Everest Ransomware Encryptor Uses ConfuserEx-Protected .NET Binary With Wake-on-LAN Capability
- Everest Ransomware
- Feuding Ransomware Groups Leak Each Other's Data
- Everest Ransomware: Complete Guide
Threats related to Everest Ransomware
- Everest Ransomware Gang Extorts Stadler Rail via Compromised Supplier Credentials, CHF 10M Demand Refused
- Everest Ransomware Group Demands $12.3M from Stadler Rail via Third-Party Supplier Breach
- Everest Ransomware Gang Breaches Stadler Rail Supplier Data Exchange Platform, Demands $12.3M (CHF 10M) Ransom
- The Gentlemen RaaS (Storm-2697) — Multi-Platform Ransomware-as-a-Service with BYOVD Defense Evasion and Self-Propagating Go Encryptor
- Insider Ransomware Negotiators Colluded with BlackCat/ALPHV, Cost Victims $75M+ — DigitalMint's Angelo Martino Sentenced to 70 Months
- Ransom Cartel ransomware creator Maksim Silnikau sentenced to 16 years in federal prison
Detection coverage for TL-2026-1172
As of 2026-07-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1172 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.