Threat reportRansomwareTL-2026-4223
Everest Ransomware Group Claims 590 GB PwC Data Theft (Unverified)
Everest Ransomware Group Claims 590 GB PwC Data Theft (TL-2026-4223) is a medium-severity ransomware operation, first published 2026-10-23. It is attributed to Everest ransomware group with low confidence, affects PwC Corporate data (HR, training/e-learning, internal audit methods, maps to 10 MITRE ATT&CK techniques (T1003.001, T1003.003, T1021.001), and is covered by 9 detection rules and 22 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 10MITRE ATT&CK
- Actors
- 1Everest ransomware group
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 22Indicators of compromise
Key facts for TL-2026-4223
- Threat ID
- TL-2026-4223
- Severity
- MEDIUM
- Status
- TRACKING
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution
- Everest ransomware group
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- professional services, consulting, audit
- Target regions
- australia, china, canada, united kingdom
- Detection rules
- 9
- Indicators of compromise
- 22
Malware and tooling in Everest Ransomware Group Claims 590 GB PwC Data Theft
Malware and tooling: AnyDesk, BlackByte, Cobalt Strike, Everest, Everest ransomware, AnyDesk, Atera, Cobalt Strike, ProcDump, SoftPerfect Network Scanner, Splashtop, WinRAR
How Everest Ransomware Group Claims 590 GB PwC Data Theft works
The Everest ransomware group claims to have stolen 590.69 GB (108,426 files) from PwC, including HR records, training content, internal audit methods and single sign-on source code and configuration files. The claim is unverified; no PwC response was identified and data authenticity, ownership and access scope remain open questions.
On 2026-10-22 the threat tracker Hackmanac publicly flagged a new listing on the Everest ransomware group's leak site naming PwC as a victim. CTIWatch's victim tracker also documented the listing. Cyber Security News reported the claim on 2026-10-23. According to that reporting, Everest claims 590.69 GB across 108,426 files, organised in 494 directories, 1,333 original archive containers and 53 nested containers.
Claimed content includes human resources records (213,084 entries; the number of unique individuals is unknown), training files and e-learning courses, integration testing documents, internal audit methods, confidential documents, and 'single sign-on source code and configuration files'. The geographic scope referenced covers Australia, China, Canada and the UK. One directory is named pwc-stg.csod.com, which points to a staging tenant on the Cornerstone OnDemand (csod.com) learning-management platform. This suggests the material may originate from a third-party SaaS/LMS environment or an export of it rather than from PwC's core network. That is an inference, not a confirmed fact.
Caveats: the claim is single-sourced and unverified. No PwC response was identified. No ransom demand, encryption event, initial access vector, CVE or IOC specific to this incident has been published. An alleged deadline of 2026-10-28 is also unconfirmed. Severity is held at MEDIUM pending verification.
Background on the actor: Everest has operated since at least December 2020 and has evolved from data-theft extortion into ransomware operations and increasingly initial access brokerage (first observed November 2021). NCC Group assessed with medium confidence that Everest ransomware is related to BlackByte (C# variant). NCC's incident-response reporting documents TTPs including exploitation of external remote services, RDP lateral movement with compromised accounts, LSASS and NTDS.dit credential dumping, Cobalt Strike and Metasploit C2, remote-access tools (AnyDesk, Splashtop, Atera) for persistence, WinRAR archiving and double extortion. These are historical group TTPs and are NOT confirmed for the PwC claim. The IOCs listed are from that earlier NCC reporting and are not linked to this incident. Everest's leak site was defaced and taken offline in April 2025 by an unknown party, but the group has since resumed publishing victims.
MITRE ATT&CK techniques used in TL-2026-4223
Credential Access
T1003.001 OS Credential Dumping: LSASS Memory; T1003.003 OS Credential Dumping: NTDS
Lateral Movement
T1021.001 Remote Services: Remote Desktop Protocol
Discovery
T1046 Network Service Discovery
Initial Access
T1078 Valid Accounts; T1133 External Remote Services
Command and Control
Collection
Resource Development
Impact
Affected products and versions in Everest Ransomware Group Claims 590 GB PwC Data Theft
- PwC — Corporate data (HR, training/e-learning, internal audit methods, SSO source code and configuration) - claimed, unverified
- Cornerstone OnDemand — Learning platform staging tenant pwc-stg.csod.com (referenced in directory name; involvement unconfirmed)
Remediation for Everest Ransomware Group Claims 590 GB PwC Data Theft
Immediate actions
- Monitor the Everest leak site listing and PwC statements for confirmation or retraction before acting on the claim
- Organisations with PwC engagements: review what data (HR, audit, SSO integration material) was shared with PwC and prepare for possible exposure
- Review exposure of third-party Cornerstone OnDemand (csod.com) tenants, including staging tenants; rotate API credentials and SSO secrets
- If SSO configuration or source code exposure is confirmed, rotate SAML signing certificates, client secrets and service-account credentials
Workarounds
- Alert on newly installed remote-administration tools and on WinRAR or archive creation of large data sets on file servers
Longer-term hardening
- Inventory and restrict staging/test SaaS tenants that hold production-derived data
- Enforce MFA and conditional access on all external remote services and RDP
- Deploy EDR detections for LSASS access, NTDS.dit copying and unauthorised remote-access tools (AnyDesk, Splashtop, Atera)
- Apply data-loss prevention and egress monitoring for large archive transfers
Timeline of Everest Ransomware Group Claims 590 GB PwC Data Theft
- Everest group active since at least December 2020 (approximate month per Searchlight Cyber), initially as a data-theft extortion operation
- Everest first observed acting as an Initial Access Broker (November 2021, approximate), later increasing this activity
- Everest dark web leak site reported hacked, defaced and taken offline by an unknown party (reported 2025-04-08)
- Hackmanac alerts publicly that Everest listed PwC on its leak site, claiming 590.69 GB and 108,426 files; CTIWatch tracker documents the listing
- Cyber Security News reports the claim; no PwC response identified and the claim remains unverified
- Alleged leak/publication deadline reported in coverage; unconfirmed
Sources cited for Everest Ransomware Group Claims 590 GB PwC Data Theft
- PwC Data Breach Claim - Everest Ransomware Group Claims to Have Stolen 590 GB of Data
- NCC Group - Climbing Mount Everest: Black Byte Bytes Back
- Searchlight Cyber - Everest Ransomware Group Increases Initial Access Broker Activity
- BleepingComputer - Everest ransomware's dark web leak site defaced, now offline
- TEISS - Everest ransomware gang's dark web leak site hacked and taken offline
- Breached.company - Everest threat actor profile
Detection coverage for TL-2026-4223
As of 2026-10-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4223 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.