Everest ransomware leak-site listing: "Final Notice Before Publication" (victim unnamed)

Key facts

Detection coverage

As of 2026-11-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-6006 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Everest Ransomware — LSASS Dumping with ProcDump and NTDS.dit Copy

Detects ProcDump (procdump64.exe -ma lsass.exe) and comsvcs MiniDump against LSASS, ntdsutil IFM or volume-shadow-copy extraction, and any command line touching ntds.dit / ntds.dit.zip, as used in the NCC Group Everest incident to harvest domain credentials before encryption. Also alerts on ProcDump opening LSASS (Sysmon EventCode 10).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1003.001, T1003.003
• Data sources: sysmon, windows_process_creation
• Severity: critical
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" ((EventCode=1 ((CommandLine="*procdump*" AND CommandLine="*lsass*") OR (CommandLine="*comsvcs*" AND CommandLine="*MiniDump*") OR (CommandLine="*ntdsutil*" AND CommandLine="*ifm*") OR CommandLine="*ntds.dit*" OR (CommandLine="*vssadmin*" AND CommandLine="*create shadow*"))) OR (EventCode=10 TargetImage="*lsass.exe" SourceImage="*procdump*")) | eval proc=coalesce(Image,SourceImage), acct=coalesce(User,SourceUser), detail=coalesce(CommandLine,TargetImage) | eval tl_technique=if(like(detail,"%ntds%") OR like(detail,"%shadow%") OR like(detail,"%ifm%"),"T1003.003","T1003.001") | stats count min(_time) as first_seen max(_time) as last_seen values(detail) as details values(tl_technique) as technique by host, acct, proc | convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where (ProcessCommandLine has "procdump" and ProcessCommandLine has "lsass")
    or (ProcessCommandLine has "comsvcs" and ProcessCommandLine has "MiniDump")
    or (ProcessCommandLine has "ntdsutil" and ProcessCommandLine has "ifm")
    or ProcessCommandLine has "ntds.dit"
    or (ProcessCommandLine has "vssadmin" and ProcessCommandLine has "create shadow")
| extend Technique = iff(ProcessCommandLine has_any ("ntds","shadow","ifm"), "T1003.003", "T1003.001")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, Technique
| order by Timestamp desc

Sigma

title: Everest Ransomware Credential Dumping - ProcDump LSASS and NTDS.dit Extraction
id: 9b4d7e20-1c63-4f8a-b5a9-2e7d3c18f402
status: experimental
description: Detects ProcDump or comsvcs MiniDump against LSASS and ntdsutil, shadow-copy or direct ntds.dit extraction, matching the Everest ransomware intrusion documented by NCC Group.
references:
    - https://www.nccgroup.com/research/climbing-mount-everest-black-byte-bytes-back/
author: Threadlinqs Team
date: 2026/11/13
tags:
    - attack.credential_access
    - attack.t1003.001
    - attack.t1003.003
logsource:
    category: process_creation
    product: windows
detection:
    selection_procdump:
        CommandLine|contains|all:
            - 'procdump'
            - 'lsass'
    selection_comsvcs:
        CommandLine|contains|all:
            - 'comsvcs'
            - 'MiniDump'
    selection_ntdsutil:
        CommandLine|contains|all:
            - 'ntdsutil'
            - 'ifm'
    selection_ntds:
        CommandLine|contains: 'ntds.dit'
    selection_vss:
        CommandLine|contains|all:
            - 'vssadmin'
            - 'create shadow'
    condition: 1 of selection_*
falsepositives:
    - Authorised incident response or red-team credential-dumping exercises
    - Backup or AD maintenance tooling that references ntds.dit
level: critical

Known false positives:

• Authorised IR or red-team credential-dumping exercises
• AD backup or maintenance tooling that references ntds.dit

Tuning notes: Exclude domain-controller backup service accounts and approved IR hosts. Pair with Sysmon EventCode 10 (LSASS access) telemetry for coverage that does not depend on command-line text; the SPL already includes the ProcDump-to-LSASS access branch.

• 🔒 Everest Ransomware — External Remote Desktop Logon from Public IP (Initial Access / RDP) · unlock with TL Creds
• 🔒 Everest Ransomware — SoftPerfect NetScan Discovery and WinRAR Data Staging · unlock with TL Creds
• 🔒 Everest Ransomware — SMB Admin Share Lateral Movement Fan-Out · unlock with TL Creds
• 🔒 Everest Ransomware — Unapproved RMM Tool (AnyDesk, Splashtop, Atera) Installed as a Service · unlock with TL Creds
• 🔒 Everest Ransomware — Inhibit System Recovery, Backup Service Stop and Self-Deletion · unlock with TL Creds
• 🔒 Everest Ransomware — Ransom Note, [indicator] Encrypted Files and Known Sample Artifacts · unlock with TL Creds
• 🔒 Everest Ransomware — PowerShell/Cmd Download Cradle Staging Cobalt Strike or Metasploit Payload · unlock with TL Creds
• 🔒 Everest Ransomware — Cobalt Strike / Meterpreter C2 Beaconing to Known Infrastructure and Port 10443 · unlock with TL Creds

Indicators of compromise

As of 2026-11-13, Threadlinqs Intelligence tracks 26 indicators of compromise for TL-2026-6006.

Sample indicators (3 of 26)

• IP address: 3.22.79[.]23
• Domain: everestndkvzcibcje2cqxhre2hmmybl3rn2gwzwsblz7gx6uryn5rad[.]onion
• File hash: 1df92bf4c967297d8a39fc3f619a56702ee96d5cf9196b8e1d5b3654746c6514

Defanged, TLP:CLEAR. Full set of 26 indicators: unlock with TL Creds.

Technical analysis

Treat as a low-confidence monitoring item; the actionable value is the documented Everest tradecraft and indicators.

On 2026-11-13 the ransomware.live tracker recorded a listing attributed to the Everest group titled "Final Notice Before Publication". The tracker shows an estimated attack date of 2026-11-13, a discovery time of 22:44 UTC, the sector as "Other", and no country. No onion URL is tied to the listing, only a leak screenshot hosted by the tracker. The page's description is AI-generated, says the title does not match a known company, and says the phrase is commonly used in extortion and double-extortion campaigns. The real victim, data volume and type of claim are therefore unknown, and no CVE, malware sample, IOC or TTP is tied to this specific listing.

The tracker's group profile lists Everest as active since 2021-09-09 with about 430 listed victims in 38 countries, top sectors of Professional Services, Healthcare, Technology, Manufacturing and Financial Services, and the United States as the most-affected country. The same profile warns that some entries are not company names (for example "Final Notice Before Publication", "111" and "ETS"), so victim counts may include placeholder entries. Reporting by Searchlight Cyber (2023-06-26) says Everest has been active since at least December 2020, was first seen acting as an initial access broker in November 2021, and often deletes its leak-site advertisements. ZeroFox, as relayed in secondary reporting, assessed that Everest has overstated breach claims to add pressure and that leak-site announcements by themselves provide no distinct indicators of compromise.

Documented Everest tradecraft comes from earlier incident work. NCC Group (2022-07-13) analysed an Everest ransomware binary recovered during incident response and assessed with medium confidence that Everest is related to Black-Byte; the sample was C# whereas earlier Black-Byte samples were Go. The intrusion used access through an insecure external service, PowerShell and cmd execution, RDP lateral movement, remote access tools installed as services (AnyDesk, Splashtop, Atera), ProcDump against LSASS, NTDS.dit copying, SoftPerfect network scanning, WinRAR archiving, Cobalt Strike over HTTPS plus a Metasploit payload, and exfiltration through Splashtop file transfer before encryption. HHS HC3 (August 2024, relayed by AHA) describes Everest as increasingly targeting healthcare, gaining access through compromised user accounts and common remote access tools, and using Cobalt Strike. AttackIQ (2026-07-02) analysed a per-victim, ConfuserEx-protected .NET 4.0 sample that declares AES-256 and RSA-4096 but effectively uses AES-128-CBC and RSA-1024, skips hosts with CIS locales, stops security services, deletes shadow copies and backups, encrypts to the .everest extension and drops _EVERESTRANSOMWARE.txt. AttackIQ notes the claimed 1 TB theft was not backed by exfiltration code in the binary and that hashes and artifacts may vary across deployments.

BeaconBeagle correlation for the three network IOCs (3.22.79.23, 18.193.71.144, 45.84.0.164) was attempted but the API returned HTTP 502 on two attempts, so no C2 correlation result is recorded. These IPs come from a 2022 incident and are likely stale. Nothing in this record should be read as confirming a compromise, a victim identity or encryption activity for the 2026-11-13 listing.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003.001 OS Credential Dumping: LSASS Memory; T1003.003 OS Credential Dumping: NTDS

Lateral Movement

T1021.001 Remote Services: Remote Desktop Protocol; T1021.002 Remote Services: SMB/Windows Admin Shares

Defense Evasion

T1027 Obfuscated Files or Information; T1070.004 Indicator Removal: File Deletion; T1480.001 Execution Guardrails: Environmental Keying

Discovery

T1046 Network Service Discovery

Execution

T1059.001 Command and Scripting Interpreter: PowerShell; T1059.003 Command and Scripting Interpreter: Windows Command Shell

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1219 Remote Access Tools

Initial Access

T1133 External Remote Services

Impact

T1489 Service Stop; T1490 Inhibit System Recovery

Persistence

T1543.003 Create or Modify System Process: Windows Service

Collection

T1560.001 Archive Collected Data: Archive via Utility

Remediation

Immediate actions

• Check whether your organization or key suppliers match the unnamed 2026-11-13 Everest listing before acting on it; the listing names no victim
• Alert on Cobalt Strike and Meterpreter beacon traffic and on RMM tools (AnyDesk, Atera, Splashtop) that are not on your approved list
• Hunt for ProcDump or other LSASS access and for NTDS.dit copies
• Search endpoints for the .everest extension, _EVERESTRANSOMWARE.txt and the documented mutex and registry key

Workarounds

• No CVE is tied to this listing; there is no patch-based mitigation

Longer-term hardening

• Restrict and monitor external remote services and RDP, and enforce MFA on remote access
• Apply the HHS HC3 recommendation to monitor for Cobalt Strike activity
• Keep offline, immutable backups and monitor for shadow-copy deletion and mass service stops
• Monitor for data staging and archiving (WinRAR) and unusual outbound file transfer

Timeline

• 2021-09-09 Ransomware.live records 2021-09-09 as the first-seen date for Everest on its leak-site tracker.
• 2021-11-01 Searchlight Cyber reports Everest was first seen acting as an initial access broker in November 2021 (month precision; the group had been active since at least December 2020).
• 2022-07-13 NCC Group publishes incident-response analysis of an Everest binary and assesses with medium confidence that it is related to Black-Byte.
• 2023-06-26 Searchlight Cyber publishes its Ransomware Spotlight on Everest, noting increased initial access broker activity and frequent deletion of leak-site ads.
• 2024-08-20 HHS HC3 releases a TLP:CLEAR threat actor profile of Everest, warning of increased healthcare targeting.
• 2026-07-02 AttackIQ publishes analysis of a per-victim .NET Everest sample (AES-128-CBC and RSA-1024 in practice, .everest extension).
• 2026-11-13 Ransomware.live discovers an Everest leak-site listing titled "Final Notice Before Publication" at 22:44 UTC; no victim, country or claim details are stated.

Sources cited

• AHA: HC3 TLP:CLEAR threat actor profile - Everest ransomware group aha.org · Advisory · 2024-08-20
• ransomware.live victim listing: Final Notice Before Publication (Everest) ransomware.live · Research · 2026-11-13
• ransomware.live Everest group profile ransomware.live · Research · 2026-11-13
• NCC Group / Fox-IT: Climbing Mount Everest - Black-Byte bytes back nccgroup.com · Research · 2022-07-13
• Searchlight Cyber: Ransomware Spotlight - Everest group increases initial access broker activity slcyber.io · Research · 2023-06-26
• AttackIQ: Everest ransomware analysis attackiq.com · Vendor report · 2026-07-02
• AHA: HHS alerts health sector to Everest ransomware group threat (HC3 profile) aha.org · News · 2024-08-21

More in ransomware

• Pixelleaks (new group) claims data leak from Huangshi Medical Laboratory / Ezong Medical Group x Getein JV (China, healthcare)
• Ransomware Leak-Site Cadence Analysis: INCRANSOM, TheGentlemen and Audit Team Run Active Intrusion Pipelines Amid Group Consolidation
• Vexy Ransomware lists Upper Web (Brazil, Technology) as a victim
• AI-Enabled Ransomware Evolution: Machine-Speed Kill Chains and Initial Access Broker Disruption (TrendAI Assessment, ARTEX Agentic Exploitation Context)
• Qilin Ransomware Claims Cyberattack on University of Texas at Arlington; Personal Data Stolen

More from Everest

• Everest Ransomware Gang Extorts Stadler Rail via Compromised Supplier Credentials, CHF 10M Demand Refused
• Everest Ransomware Group Demands $12.3M from Stadler Rail via Third-Party Supplier Breach
• Everest Ransomware Gang Breaches Stadler Rail Supplier Data Exchange Platform, Demands $12.3M (CHF 10M) Ransom
• Everest Ransomware: Triple Extortion via Encryption, Access Brokering, and Insider Recruitment
• Dark Web Data-Leak Roundup (June 2026): Iran Hajj Organization (168M records), AdressFakta/SUPEReROI Sweden (5.4M+), Chrysler/Salesforce (1TB+, Everest Ransomware), and Crypto-Platform Lead Lists