# Everest Ransomware Group Demands $12.3M from Stadler Rail via Third-Party Supplier Breach

> Swiss train manufacturer Stadler Rail refused a 10 million Swiss franc (~$12.3M) ransom demand from the Everest ransomware/extortion group after attackers used compromised credentials to steal technical documents from a third-party supplier's file-sharing platform. Stadler's own systems and production were unaffected; the company filed a criminal complaint and did not negotiate.

- **Published:** 2026-07-22T00:00:00Z
- **Last reviewed:** 2026-07-22T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1655
- **ID:** TL-2026-1655
- **Severity:** MEDIUM
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Everest
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On or around mid-July 2026, the Russian-speaking extortion group Everest gained access to a file-sharing platform belonging to an unnamed third-party supplier of Swiss rail vehicle manufacturer Stadler Rail using compromised credentials. Rather than compromising Stadler's own network, the attackers exfiltrated technical documents that the supplier held on Stadler's behalf, then demanded 10 million Swiss francs (approximately $12.3 million USD) to prevent publication. Stadler publicly stated on July 22, 2026 that it would not pay, that no personal data was compromised, that its own IT systems and global train production/operations remained unaffected, and that it had filed a criminal complaint with Swiss authorities. As of the disclosure date, Everest had not yet listed Stadler on its dark-web leak site.

Everest is a closed-group, Russian-speaking ransomware and data-extortion operation active since December 2020 that has evolved a three-pronged business model: (1) traditional double-extortion ransomware deployment using a custom C#/.NET locker that appends the .everest extension, (2) initial-access brokerage (documented since November 2021, an unusual public-facing activity for a ransomware brand), and (3) paid corporate-insider recruitment (documented since October 2023) to obtain credentials or direct network access from employees or contractors. This incident is consistent with Everest's insider/access-broker model: the intrusion vector was a supply-chain trust relationship (a vendor's file-sharing platform) rather than direct exploitation of Stadler's perimeter, and no ransomware payload was reportedly deployed — the operation was pure data-theft extortion, a pattern Everest has increasingly favored to reduce forensic footprint and avoid destructive/encryption-based detection.

This is the second known extortion attempt against Stadler Rail: in May 2020, Stadler disclosed a malware-based network intrusion in which attackers claimed to have exfiltrated roughly 10,000 documents (~4 GB) and demanded approximately $6 million; Stadler refused, and the attackers subsequently published internal financial and administrative documents. The repeat targeting of the same manufacturer, five years apart, by different apparent extortion operators underscores continued interest in Stadler as a critical-infrastructure-adjacent (rail rolling stock) manufacturer, and highlights third-party/vendor risk as the now-preferred initial-access route given Stadler's own security posture holding in both incidents.

Everest's broader observed toolset — SoftPerfect Network Scanner for internal reconnaissance, Mimikatz and LSASS dumping for credential access, Cobalt Strike for lateral movement and C2, RDP and valid/purchased/insider-supplied accounts for lateral movement, and Rclone/WinSCP/WinRAR for staging and exfiltration — represents the standard playbook this actor would be expected to deploy if it escalates beyond the supplier's file-sharing platform into deeper network compromise. Everest also engages in pre-encryption defense evasion (shadow-copy and System Restore deletion, disabling Controlled Folder Access, removing the open-source anti-ransomware tool Raccine, deleting backup files) when it does deploy its locker, though no locker deployment has been reported in the Stadler case as of publication.

## MITRE ATT&CK

- T1595 Active Scanning
- T1583 Acquire Infrastructure
- T1588 Obtain Capabilities
- T1078 Valid Accounts
- T1199 Trusted Relationship
- T1190 Exploit Public-Facing Application
- T1566 Phishing
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1078 Valid Accounts
- T1055 Process Injection
- T1112 Modify Registry
- T1070 Indicator Removal
- T1027 Obfuscated Files or Information
- T1685 Disable or Modify Tools
- T1490 Inhibit System Recovery
- T1003 OS Credential Dumping
- T1552 Unsecured Credentials
- T1018 Remote System Discovery
- T1016 System Network Configuration Discovery
- T1046 Network Service Discovery
- T1021 Remote Services
- T1560 Archive Collected Data
- T1213 Data from Information Repositories
- T1071 Application Layer Protocol
- T1567 Exfiltration Over Web Service
- T1041 Exfiltration Over C2 Channel
- T1486 Data Encrypted for Impact
- T1657 Financial Theft

## Sources

- [Stadler refuses Everest ransom demand](https://therecord.media/stadler-refuses-everest-ransom-demand)
- [Swiss rail giant Stadler rejects $12.3M ransom demand after cyberattack](https://www.bleepingcomputer.com/news/security/swiss-rail-giant-stadler-rejects-123m-ransom-demand-after-cyberattack/)
- [Stadler Rail refuses to pay $12.3 million ransom after ransomware attack](https://www.scworld.com/brief/stadler-rail-refuses-to-pay-12-3-million-ransom-after-ransomware-attack)
- [Ransomware Spotlight: Everest's Focus on Initial Access](https://slcyber.io/whitepapers-reports/ransomware-spotlight-everest-group-focuses-on-initial-access-brokerage/)
- [Everest Ransomware: Triple Threat of Encryption, Access, and Insiders](https://www.picussecurity.com/resource/blog/everest-ransomware-triple-threat-of-encryption-access-and-insiders)
- [Everest Ransomware Group – Threat Actor Profile](https://www.cyber-defence.io/blog/everest-ransomware-group-threat-actor-profile)
- [Railway Vehicle Maker Stadler Hit by Malware Attack](https://www.securityweek.com/railway-vehicle-maker-stadler-hit-malware-attack/)
- [Internal documents published after Stadler refuses $US 6m ransom](https://www.railjournal.com/technology/internal-documents-published-after-stadler-refuses-us-6m-ransom/)
- [Swiss rail vehicle manufacturer Stadler hit by a malware-based attack](https://securityaffairs.com/103012/cyber-crime/stadler-data-breach.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1655