Threat reportRansomwareTL-2026-1683
Everest Ransomware Gang Extorts Stadler Rail via Compromised Supplier Credentials, CHF 10M Demand Refused
Everest Ransomware Gang Extorts Stadler Rail via Compromised (TL-2026-1683), also tracked as Stadler Rail Supplier Data-Exchange Breach, is a medium-severity ransomware operation, first published 2026-07-25. It is attributed to Everest with high confidence, affects Stadler Rail Supplier data-exchange / trading platform (third-party, maps to 19 MITRE ATT&CK techniques (T1003, T1021, T1041), and is covered by 9 detection rules and 22 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 19MITRE ATT&CK
- Actors
- 1Everest
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 22Indicators of compromise
Key facts for TL-2026-1683
- Threat ID
- TL-2026-1683
- Also known as
- Stadler Rail Supplier Data-Exchange Breach
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution
- Everest
- Attribution confidence
- HIGH
- Motivation
- FINANCIAL
- Target sectors
- manufacturing, transport, rail, health, professional-services, technology, financial-services
- Target regions
- Europe, switzerland, North America
- Detection rules
- 9
- Indicators of compromise
- 22
Malware and tooling in Everest Ransomware Gang Extorts Stadler Rail via Compromised
Malware and tooling: Everest Ransomware, AnyDesk, Atera, Cobalt Strike, Mimikatz, ProcDump, Rclone - S1040, SoftPerfect Network Scanner, Splashtop, WinRAR, WinSCP
How Everest Ransomware Gang Extorts Stadler Rail via Compromised works
The Everest ransomware/extortion gang accessed technical data belonging to Swiss train manufacturer Stadler Rail after compromising an unnamed supplier's credentials on a shared data-exchange platform, demanding a CHF 10 million (~$12.3M) ransom. Stadler refused to pay, filed a criminal complaint with Thurgau cantonal police, and states its own IT systems and personal/security-relevant data were not affected; Stadler has not appeared on Everest's leak site and no data has been publicly leaked.
In mid-July 2026 the Everest ransomware and extortion group compromised login credentials for a third-party data-exchange (trading) platform used by Swiss rolling-stock manufacturer Stadler Rail to share technical information with an unnamed supplier. Using those valid, compromised credentials (MITRE T1078 — Valid Accounts), the actor accessed and exfiltrated technical data belonging to the supplier that was stored on or transiting the shared platform. Stadler's own corporate IT environment, production/operational technology, and rolling-stock systems were not accessed or disrupted, and the company states no security-relevant or personal data was involved.
Everest subsequently issued a CHF 10 million (~$12.3 million) extortion demand to Stadler. Stadler publicly refused to pay under any circumstances, disclosed the incident on 21 July 2026, and filed a criminal complaint with the Thurgau Cantonal Police (its home canton in Switzerland). As of the reporting date Stadler has not appeared on Everest's Tor leak site and no stolen data has been published, an outcome the reporting characterizes as atypical for Everest's usual extortion playbook of staged leak-site listings and countdown timers following a refusal.
Everest is a Russian-speaking, financially motivated ransomware/extortion operation first observed in December 2020 (leak-site presence tracked from September 2021), which encrypts Windows hosts with a ConfuserEx-protected .NET encryptor (dual AES/RSA scheme, files marked with the .everest/.EVEREST extension) while increasingly favoring pure data-theft extortion without encryption since 2024. The group runs a three-stream business model: direct ransomware extortion (Monero-preferred payment), sale of initial access as an Initial Access Broker (IAB) since November 2021 — a role rare among ransomware crews — and a paid corporate-insider recruitment program since October 2023 targeting employees at US, Canadian, and European organizations willing to provide remote access. Known prior/claimed victims include Under Armour, Mailchimp, AT&T, Collins Aerospace, and an Asus supplier, with 365 total leak-site victims across 35 countries concentrated in healthcare, professional services, manufacturing, technology, and financial services, and heaviest activity in the United States. This incident extends Everest's established pattern of targeting organizations through their supply chain / third-party data-exchange platforms rather than direct network compromise, consistent with its IAB/insider-driven access model and its focus on manufacturing-sector victims.
MITRE ATT&CK techniques used in TL-2026-1683
Credential Access
Lateral Movement
Exfiltration
T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
Discovery
T1046 Network Service Discovery; T1135 Network Share Discovery
Defense Evasion
Command and Control
T1071 Application Layer Protocol; T1219 Remote Access Tools
Initial Access
T1078 Valid Accounts; T1133 External Remote Services; T1566 Phishing
stealth
Persistence
T1078 Valid Accounts; T1543 Create or Modify System Process
Impact
T1486 Data Encrypted for Impact; T1657 Financial Theft
Collection
Resource Development
T1585 Establish Accounts; T1650 Acquire Access
defense-impairment
Affected products and versions in Everest Ransomware Gang Extorts Stadler Rail via Compromised
- Stadler Rail — Supplier data-exchange / trading platform (third-party, unnamed supplier)
Vulnerable versions: N/A - credential compromise, not a software vulnerability
Fixed in: N/A
Remediation for Everest Ransomware Gang Extorts Stadler Rail via Compromised
Immediate actions
- Audit and rotate all credentials used on third-party/supplier data-exchange and trading platforms
- Enforce MFA on every supplier-facing portal, EDI/data-exchange platform, and vendor extranet account
- Review supplier access logs for anomalous logins, geographic outliers, and off-hours authentication on shared exchange platforms
- Notify and coordinate with affected suppliers to scope the blast radius of the credential compromise
- Preserve logs and engage law enforcement / national CERT given the criminal complaint precedent (Thurgau Cantonal Police)
Workarounds
- Temporarily disable or restrict the compromised supplier data-exchange platform pending credential rotation and forensic review
- Require step-up authentication or IP allow-listing for supplier accounts on shared exchange platforms
Longer-term hardening
- Implement zero-trust segmentation between supplier-facing data-exchange platforms and core enterprise IT/OT networks
- Deploy EDR with behavioral detection tuned for Cobalt Strike, ProcDump, and RMM-tool abuse (AnyDesk, Atera, Splashtop)
- Establish a third-party/supply-chain risk program with mandatory MFA and credential-hygiene requirements for suppliers with data-exchange access
- Monitor dark-web/IAB marketplaces and leak sites for exposure of organizational or supplier credentials
- Run tabletop exercises simulating supplier-credential-compromise extortion scenarios
Weaknesses (CWE) in Everest Ransomware Gang Extorts Stadler Rail via Compromised
Timeline of Everest Ransomware Gang Extorts Stadler Rail via Compromised
- Everest ransomware/extortion group first observed active, per multiple threat-intel profiles (Halcyon, SOCRadar, Picus).
- Everest's Tor leak site first tracked/indexed by ransomware.live.
- Everest begins operating as an Initial Access Broker (IAB), selling network access alongside its ransomware/extortion operations.
- Everest launches a paid corporate-insider recruitment program offering cash/profit-sharing for remote access to US, Canadian, and European organizations.
- Reporting indicates Everest increasingly shifts to data-only extortion without file encryption in many intrusions.
- Last victim posted to Everest's leak site prior to the Stadler incident, per ransomware.live tracking.
- Approximate window (mid-July 2026) in which Everest compromised login credentials for a Stadler Rail supplier's data-exchange/trading platform and accessed technical data.
- Stadler Rail publicly discloses the incident, confirms refusal to pay the CHF 10 million ransom, and files a criminal complaint with the Thurgau Cantonal Police.
- Broad security-media coverage of the incident (The Register, Help Net Security, Rescana, swissinfo.ch, Railway Gazette) confirms details and notes Stadler has not appeared on Everest's leak site.
Sources cited for Everest Ransomware Gang Extorts Stadler Rail via Compromised
- Stadler Rail scoffs at Everest's $12.3M extortion attempts
- Hackers demand CHF 10 million from Stadler
- Swiss rail manufacturer Stadler refuses to pay $12.3 million ransom after cyberattack
- Stadler Rail Data-Exchange Platform Breach: Cybersecurity Incident Analysis
- Cyberattackers demand CHF10m from Swiss train maker Stadler
- Stadler refuses to pay SFr10m cyberattack ransom
- Everest Ransomware Group Expands Access Broker Activity
- Ransomware Spotlight: Everest's Focus on Initial Access Brokerage
- Everest Ransomware: Triple Threat of Encryption, Access, and Insiders
- Everest Group Targeting Critical Infrastructure
- Everest - Halcyon Threat Group Profile
- Everest Ransomware Group – Threat Actor Profile
- Dark Web Profile: Everest Ransomware
- Everest Ransomware - AttackIQ
- Ransomware.live: everest group profile
Detection coverage for TL-2026-1683
As of 2026-07-25, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1683 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.