# Everest Ransomware: Triple Extortion via Encryption, Access Brokering, and Insider Recruitment

> Everest is a Russian-speaking, closed-group Windows ransomware-as-a-service operation (.everest extension) active since December 2020, running three parallel revenue streams: double-extortion ransomware deployment, initial access brokering (since November 2021), and paid corporate insider recruitment (since October 2023). Technically linked to BlackByte ransomware via locally-generated AES keys, it has expanded from healthcare/financial/legal/construction/government/manufacturing/aviation/energy targets into claimed attacks on critical infrastructure (national power grids, airports, telecoms) through 2025-2026.

- **Published:** 2026-07-10T00:00:00Z
- **Last reviewed:** 2026-07-10T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1172
- **ID:** TL-2026-1172
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Everest
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Everest emerged in December 2020 as a data-exfiltration-focused operation targeting Canadian organizations before transitioning to full double-extortion ransomware with AES/DES encryption in early 2021. After a voluntary leak-site takedown around a law-enforcement crackdown in May 2021, the group pivoted in November 2021 to initial access brokering (IAB), selling compromised network access and stolen credentials to other threat actors. In October 2023 it launched a paid corporate insider recruitment program, offering cash payments and profit-sharing on dark web forums to employees willing to provide direct remote access to their employers' networks in the US, Canada, and Europe. From 2024 onward the group has increasingly shifted toward data-only extortion without deploying encryption at all, while continuing to run encryption-based double extortion against other victims.

Technically, Everest's ransomware payload is a ConfuserEx-1.x-obfuscated .NET/C# binary (UPX-packed in some native builds) that generates a 32-character random seed, derives an AES-128-CBC key and IV via Rfc2898DeriveBytes/PBKDF2 (1000 iterations), and wraps the seed with an embedded RSA-1024 public key -- despite the code internally declaring AES-256/RSA-4096 before silently downgrading at runtime. Encryption keys are generated locally on the compromised host rather than fetched from C2, a technique researchers have linked with medium-high confidence to the BlackByte ransomware family's C# variant (as opposed to BlackByte's original Go-based lineage); Everest is also linked to the EverBe 2.0 ransomware family lineage. Files under 10MB are fully encrypted, overwritten, and deleted; larger files receive in-place partial encryption across six non-contiguous regions.

Pre-encryption, the malware creates a unique mutex, performs CIS-locale geo-fencing checks to avoid post-Soviet-state victims (consistent with its Russian-speaking operator base), enables SeDebugPrivilege via AdjustTokenPrivileges, and runs three background monitoring threads. It methodically dismantles defenses: disabling Controlled Folder Access, modifying LocalAccountTokenFilterPolicy and EnableLinkedConnections registry values to weaken remote UAC token filtering, re-enabling SMBv1/NTLM and long file paths via registry, granting world-writable ACLs (icacls C:\* /grant Everyone:F /T /C /Q), removing the Raccine anti-ransomware tool via IFEO hooks/registry/scheduled-task cleanup, and mutating its own process security descriptor to resist taskkill. It terminates a broad target list of debuggers (x64dbg, IDA, DnSpy, ILSpy), network analyzers (Wireshark, Fiddler, TCPDump), endpoint protection (McAfee, Kaspersky, Sophos, ESET) and backup software (Veeam, Acronis, Zoolz) via Restart Manager (RmStartSession/RmShutdown) sequences, then deletes volume shadow copies and sabotages recovery options.

Network reconnaissance uses SoftPerfect Network Scanner (netscan.exe/netscanpack.exe), net view, NetDfsEnum/WNetEnumResource, and ARP-cache parsing, writing results to subnets.txt and trustdumps.txt under C:\Users\Public\Downloads. Lateral movement includes Wake-on-LAN magic-packet broadcasts (UDP ports 7/9) to wake dormant hosts and SMB/RDP-based remote services. Operators deploy Cobalt Strike as primary C2 over HTTPS, harvest LSASS memory and NTDS.dit via ProcDump, and install AnyDesk, Splashtop, and Atera as persistent Windows services for remote access -- with Splashtop's file-transfer feature used to exfiltrate archived (WinRAR) data before encryption. The group is noted for near-complete tool deletion after each operational stage, leaving fewer forensic artifacts than many peer RaaS operations. Victims are extorted via a Tor-based leak site with countdown timers and staged data releases, communications via Jabber/XMPP, onionmail, and Tox, with Monero preferred over Bitcoin for payment (BTC incurs a traceability premium). Initial access vectors are exposed RDP without MFA, vulnerable VPN endpoints, purchased/stuffed credentials, phishing, unpatched public-facing applications, and the insider-recruitment channel -- no CVE-based exploitation has been documented; the group relies entirely on misconfiguration and social/insider vectors.

Activity has escalated through 2025-2026: an April 2025 leak-site defacement ('Don't do crime CRIME IS BAD xoxo from Prague', speculatively attributed to rival group DragonForce) was followed by recovery and a July-October 2025 period described as the group's most active since inception, including claimed attacks on Heathrow/Brussels/Berlin airport systems (September 2025) and Swedish national power-grid/telecom infrastructure (October 2025). Confirmed/claimed named victims span MCNA Dental (1M+ EMRs, Nov 2024), Mitsubishi Chemical (6TB, Aug 2024), Collins Aerospace/RTX (Oct 2025), Under Armour, Petrobras, STIIIZY (422,075 customer records), Coca-Cola, Nissan, Fiserv, Liberty Mutual, TransferZ, L&P Aesthetics, and Rehab Clinics Group.

## MITRE ATT&CK

- T1133 External Remote Services
- T1078 Valid Accounts
- T1199 Trusted Relationship
- T1190 Exploit Public-Facing Application
- T1566 Phishing
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1543 Create or Modify System Process
- T1547 Boot or Logon Autostart Execution
- T1548 Abuse Elevation Control Mechanism
- T1685 Disable or Modify Tools
- T1112 Modify Registry
- T1140 Deobfuscate/Decode Files or Information
- T1222 File and Directory Permissions Modification
- T1070 Indicator Removal
- T1564 Hide Artifacts
- T1497 Virtualization/Sandbox Evasion
- T1003 OS Credential Dumping
- T1087 Account Discovery
- T1580 Cloud Infrastructure Discovery
- T1538 Cloud Service Dashboard
- T1018 Remote System Discovery
- T1135 Network Share Discovery
- T1040 Network Sniffing
- T1046 Network Service Discovery
- T1083 File and Directory Discovery
- T1615 Group Policy Discovery
- T1057 Process Discovery
- T1082 System Information Discovery
- T1021 Remote Services
- T1560 Archive Collected Data
- T1071 Application Layer Protocol
- T1219 Remote Access Tools
- T1041 Exfiltration Over C2 Channel
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
- T1531 Account Access Removal
- T1485 Data Destruction
- T1529 System Shutdown/Reboot

## Sources

- [Everest Ransomware: Triple Threat of Encryption, Access, and Insiders](https://www.picussecurity.com/resource/blog/everest-ransomware-triple-threat-of-encryption-access-and-insiders)
- [Everest (threat group profile)](https://www.halcyon.ai/threat-group/everest)
- [Alert: Everest Group Targeting Critical Infrastructure](https://www.halcyon.ai/ransomware-alerts/alert-everest-group-targeting-critical-infrastructure)
- [Everest (group technical profile / IOCs)](https://www.ransomlook.io/group/everest)
- [Everest Ransomware](https://www.attackiq.com/2026/07/02/everest-ransomware/)
- [Climbing Mount Everest: Black-Byte Bytes Back?](https://www.nccgroup.com/research/climbing-mount-everest-black-byte-bytes-back/)
- [Everest Ransomware Encryptor Uses ConfuserEx-Protected .NET Binary With Wake-on-LAN Capability](https://gbhackers.com/everest-ransomware-attack/)
- [Everest Ransomware](https://securityboulevard.com/2026/07/everest-ransomware/)
- [Feuding Ransomware Groups Leak Each Other's Data](https://www.darkreading.com/threat-intelligence/feuding-ransomware-groups-leak-data)
- [Everest Ransomware: Complete Guide](https://www.salvagedata.com/blog/everest-ransomware)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1172