# Everest Ransomware Gang Extorts Stadler Rail via Compromised Supplier Credentials, CHF 10M Demand Refused

> The Everest ransomware/extortion gang accessed technical data belonging to Swiss train manufacturer Stadler Rail after compromising an unnamed supplier's credentials on a shared data-exchange platform, demanding a CHF 10 million (~$12.3M) ransom. Stadler refused to pay, filed a criminal complaint with Thurgau cantonal police, and states its own IT systems and personal/security-relevant data were not affected; Stadler has not appeared on Everest's leak site and no data has been publicly leaked.

- **Published:** 2026-07-25T00:00:00Z
- **Last reviewed:** 2026-07-25T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1683
- **ID:** TL-2026-1683
- **Severity:** MEDIUM
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Everest
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)

## Description

In mid-July 2026 the Everest ransomware and extortion group compromised login credentials for a third-party data-exchange (trading) platform used by Swiss rolling-stock manufacturer Stadler Rail to share technical information with an unnamed supplier. Using those valid, compromised credentials (MITRE T1078 — Valid Accounts), the actor accessed and exfiltrated technical data belonging to the supplier that was stored on or transiting the shared platform. Stadler's own corporate IT environment, production/operational technology, and rolling-stock systems were not accessed or disrupted, and the company states no security-relevant or personal data was involved.

Everest subsequently issued a CHF 10 million (~$12.3 million) extortion demand to Stadler. Stadler publicly refused to pay under any circumstances, disclosed the incident on 21 July 2026, and filed a criminal complaint with the Thurgau Cantonal Police (its home canton in Switzerland). As of the reporting date Stadler has not appeared on Everest's Tor leak site and no stolen data has been published, an outcome the reporting characterizes as atypical for Everest's usual extortion playbook of staged leak-site listings and countdown timers following a refusal.

Everest is a Russian-speaking, financially motivated ransomware/extortion operation first observed in December 2020 (leak-site presence tracked from September 2021), which encrypts Windows hosts with a ConfuserEx-protected .NET encryptor (dual AES/RSA scheme, files marked with the .everest/.EVEREST extension) while increasingly favoring pure data-theft extortion without encryption since 2024. The group runs a three-stream business model: direct ransomware extortion (Monero-preferred payment), sale of initial access as an Initial Access Broker (IAB) since November 2021 — a role rare among ransomware crews — and a paid corporate-insider recruitment program since October 2023 targeting employees at US, Canadian, and European organizations willing to provide remote access. Known prior/claimed victims include Under Armour, Mailchimp, AT&T, Collins Aerospace, and an Asus supplier, with 365 total leak-site victims across 35 countries concentrated in healthcare, professional services, manufacturing, technology, and financial services, and heaviest activity in the United States. This incident extends Everest's established pattern of targeting organizations through their supply chain / third-party data-exchange platforms rather than direct network compromise, consistent with its IAB/insider-driven access model and its focus on manufacturing-sector victims.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1133 External Remote Services
- T1566 Phishing
- T1585 Establish Accounts
- T1650 Acquire Access
- T1003 OS Credential Dumping
- T1078 Valid Accounts
- T1046 Network Service Discovery
- T1135 Network Share Discovery
- T1070 Indicator Removal
- T1685 Disable or Modify Tools
- T1543 Create or Modify System Process
- T1078 Valid Accounts
- T1021 Remote Services
- T1071 Application Layer Protocol
- T1219 Remote Access Tools
- T1560 Archive Collected Data
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service
- T1486 Data Encrypted for Impact
- T1657 Financial Theft

## Sources

- [Stadler Rail scoffs at Everest's $12.3M extortion attempts](https://www.theregister.com/security/2026/07/23/stadler-rail-scoffs-at-eversts-123m-extortion-attempts/5276922)
- [Hackers demand CHF 10 million from Stadler](https://www.railwaypro.com/wp/hackers-demand-chf-10-million-from-stadler/)
- [Swiss rail manufacturer Stadler refuses to pay $12.3 million ransom after cyberattack](https://www.helpnetsecurity.com/2026/07/23/stadler-everest-ransom-demand/)
- [Stadler Rail Data-Exchange Platform Breach: Cybersecurity Incident Analysis](https://www.rescana.com/post/stadler-rail-data-exchange-platform-breach-cybersecurity-incident-analysis-of-everest-ransomware-attack-and-12-3m-ransom)
- [Cyberattackers demand CHF10m from Swiss train maker Stadler](https://www.swissinfo.ch/eng/various/stadler-hit-by-a-cyberattack-10-million-demanded-as-ransom/91777189)
- [Stadler refuses to pay SFr10m cyberattack ransom](https://www.railwaygazette.com/stadler/2026/07/21/stadler-refuses-to-pay-sfr10m-cyberattack-ransom/)
- [Everest Ransomware Group Expands Access Broker Activity](https://slcyber.io/everest-ransomware-group-increases-initial-access-broker-activity/)
- [Ransomware Spotlight: Everest's Focus on Initial Access Brokerage](https://slcyber.io/whitepapers-reports/ransomware-spotlight-everest-group-focuses-on-initial-access-brokerage/)
- [Everest Ransomware: Triple Threat of Encryption, Access, and Insiders](https://www.picussecurity.com/resource/blog/everest-ransomware-triple-threat-of-encryption-access-and-insiders)
- [Everest Group Targeting Critical Infrastructure](https://www.halcyon.ai/ransomware-alerts/alert-everest-group-targeting-critical-infrastructure)
- [Everest - Halcyon Threat Group Profile](https://www.halcyon.ai/threat-group/everest)
- [Everest Ransomware Group – Threat Actor Profile](https://www.cyber-defence.io/blog/everest-ransomware-group-threat-actor-profile)
- [Dark Web Profile: Everest Ransomware](https://socradar.io/blog/dark-web-profile-everest-ransomware/)
- [Everest Ransomware - AttackIQ](https://www.attackiq.com/2026/07/02/everest-ransomware/)
- [Ransomware.live: everest group profile](https://www.ransomware.live/group/everest)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1683