# Everest Ransomware Gang Breaches Stadler Rail Supplier Data Exchange Platform, Demands $12.3M (CHF 10M) Ransom

> The Everest ransomware/extortion gang compromised login credentials for a supplier-facing data exchange platform used by Swiss rail manufacturer Stadler Rail, stealing non-sensitive technical documentation and demanding $12.3 million (CHF 10 million). Stadler publicly refused to pay, filed a criminal complaint with Thurgau cantonal police, and confirmed its IT systems, production lines, and in-service rail vehicles worldwide were unaffected.

- **Published:** 2026-07-22T00:00:00Z
- **Last reviewed:** 2026-07-22T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1642
- **ID:** TL-2026-1642
- **Severity:** MEDIUM
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Everest
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

In mid-July 2026, the Everest ransomware/data-extortion group gained unauthorized access to a third-party data exchange (trading) platform used by Stadler Rail — an 18,000-employee Swiss rolling-stock manufacturer with roughly $4.9B in annual revenue and eight production facilities worldwide — to share design documentation and component specifications with one of its suppliers. Public reporting is consistent that the initial access vector was compromised login credentials for that shared platform rather than a vulnerability in Stadler's own network; no CVE has been disclosed, and Stadler has stated its internal IT systems were not compromised and continued to operate normally. Everest exfiltrated a set of technical files described by Stadler as containing no personal data and posing no bearing on railway safety, then demanded $12.3 million (CHF 10 million) not to leak the material, publishing the claim on its Tor-based leak/extortion site consistent with its established double-extortion (now largely pure-extortion/IAB-hybrid) business model. Stadler publicly rejected the demand — "Stadler will not pay any ransom under any circumstances and is therefore not susceptible to extortion" — and filed a criminal complaint with the Thurgau cantonal police (the canton where Stadler is headquartered, in Bussnang, Switzerland). This is Stadler's second publicly known cyber incident, following a 2020 malware/data-theft intrusion.

Everest (active since December 2020, ransomware code lineage traced to EverBe 2.0 with more recent code-level overlap noted with BlackByte) has evolved from double-extortion ransomware deployment into a primarily data-theft/extortion and initial-access-broker (IAB) operation, increasingly monetizing compromised access itself rather than always deploying an encryptor. The group has claimed victims across government, healthcare, manufacturing, aviation (Collins Aerospace, Dublin Airport passenger data), retail (Under Armour), legal, education, finance, logistics, and technology-reseller sectors across North America, Europe, and Asia, and geo-fences its encryptor against CIS-locale systems (Russian, Ukrainian, Kazakh, Belarusian), a strong indicator of Russian/CIS-region operator affiliation. This incident fits Everest's established initial-access pattern — compromising credentials for a trusted third-party platform (a supplier/partner data-exchange system) rather than attacking the primary target directly — extending Everest's supply-chain/third-party-platform targeting into the rail/industrial-manufacturing sector.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1078.001 Default Accounts
- T1199 Trusted Relationship
- T1190 Exploit Public-Facing Application
- T1566.001 Spearphishing Attachment
- T1003.001 LSASS Memory
- T1552 Unsecured Credentials
- T1018 Remote System Discovery
- T1046 Network Service Discovery
- T1082 System Information Discovery
- T1021 Remote Services
- T1021.001 Remote Desktop Protocol
- T1560.001 Archive via Utility
- T1074 Data Staged
- T1567 Exfiltration Over Web Service
- T1020 Automated Exfiltration
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
- T1489 Service Stop
- T1657 Financial Theft
- T1685 Disable or Modify Tools
- T1070 Indicator Removal
- T1027 Obfuscated Files or Information
- T1112 Modify Registry
- T1055 Process Injection
- T1548 Abuse Elevation Control Mechanism
- T1105 Ingress Tool Transfer
- T1090.003 Multi-hop Proxy
- T1583.004 Server

## Sources

- [Swiss rail giant Stadler rejects $12.3M ransom demand after cyberattack](https://www.bleepingcomputer.com/news/security/swiss-rail-giant-stadler-rejects-123m-ransom-demand-after-cyberattack/)
- [Cyberattackers demand CHF10m from Swiss train maker Stadler](https://www.swissinfo.ch/eng/various/stadler-hit-by-a-cyberattack-10-million-demanded-as-ransom/91777189)
- [Stadler refuses to pay SFr10m cyberattack ransom](https://www.railwaygazette.com/stadler/2026/07/21/stadler-refuses-to-pay-sfr10m-cyberattack-ransom/)
- [Stadler Rail Rejects $12.3 Million Ransom After Supplier Breach](https://sqmagazine.co.uk/stadler-rail-rejects-12-3-million-ransom/)
- [Hackers Demand CHF 10 Million Ransom From Stadler Rail](https://www.thetraveler.org/hackers-demand-chf-10-million-ransom-from-stadler-rail/)
- [Hackers demand CHF 10 million from Stadler](https://www.railwaypro.com/wp/hackers-demand-chf-10-million-from-stadler/)
- [Stadler Rail refuses to pay $12.3 million ransom after ransomware attack](https://www.scworld.com/brief/stadler-rail-refuses-to-pay-12-3-million-ransom-after-ransomware-attack)
- [Ransomware Spotlight: Everest's Focus on Initial Access](https://slcyber.io/whitepapers-reports/ransomware-spotlight-everest-group-focuses-on-initial-access-brokerage/)
- [Everest Ransomware Group Increases Initial Access Broker Activity](https://slcyber.io/blog/everest-ransomware-group-increases-initial-access-broker-activity/)
- [Everest Ransomware Group – Threat Actor Profile](https://www.cyber-defence.io/blog/everest-ransomware-group-threat-actor-profile)
- [Everest Ransomware (AttackIQ technical intelligence summary)](https://www.attackiq.com/2026/07/02/everest-ransomware/)
- [Everest Ransomware Group Claims Theft of 1.5 Million Passenger Records from Dublin Airport](https://www.iisf.ie/hacked-Millions-of-Passenger-Records-Dublin-Airport)
- [Under Armour Customer Data Breach 2025: Technical Analysis of Everest Ransomware Attack](https://www.rescana.com/post/under-armour-customer-data-breach-2025-technical-analysis-of-everest-ransomware-attack-and-exposed)
- [Everest Ransomware Hits Collins Aerospace & European Airports](https://www.protoslabs.io/resources/deep-dive-analysis-collins-aerospace-ransomware-attack-claimed-by-everest-group)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1642