# Everest ransomware leak-site listing: "Final Notice Before Publication" (victim unnamed)

> Ransomware.live recorded a new Everest leak-site listing titled "Final Notice Before Publication" on 2026-11-13 (discovered 22:44 UTC). No victim company, country, sector detail or claim content is stated, and the tracker's own AI-generated note says the title does not correspond to a known company. Treat as a low-confidence monitoring item; the actionable value is the documented Everest tradecraft and indicators.

- **Published:** 2026-11-13T22:59:38Z
- **Last reviewed:** 2026-11-13T22:59:38Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-6006
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-6006.png
- **ID:** TL-2026-6006
- **Severity:** MEDIUM
- **Category:** RANSOMWARE
- **Status:** MONITORING
- **Actor:** Everest
- **Detections:** 9 (1 shown free below) · **IOCs:** 26 (3 shown free below)

## Description

On 2026-11-13 the ransomware.live tracker recorded a listing attributed to the Everest group titled "Final Notice Before Publication". The tracker shows an estimated attack date of 2026-11-13, a discovery time of 22:44 UTC, the sector as "Other", and no country. No onion URL is tied to the listing, only a leak screenshot hosted by the tracker. The page's description is AI-generated, says the title does not match a known company, and says the phrase is commonly used in extortion and double-extortion campaigns. The real victim, data volume and type of claim are therefore unknown, and no CVE, malware sample, IOC or TTP is tied to this specific listing.

The tracker's group profile lists Everest as active since 2021-09-09 with about 430 listed victims in 38 countries, top sectors of Professional Services, Healthcare, Technology, Manufacturing and Financial Services, and the United States as the most-affected country. The same profile warns that some entries are not company names (for example "Final Notice Before Publication", "111" and "ETS"), so victim counts may include placeholder entries. Reporting by Searchlight Cyber (2023-06-26) says Everest has been active since at least December 2020, was first seen acting as an initial access broker in November 2021, and often deletes its leak-site advertisements. ZeroFox, as relayed in secondary reporting, assessed that Everest has overstated breach claims to add pressure and that leak-site announcements by themselves provide no distinct indicators of compromise.

Documented Everest tradecraft comes from earlier incident work. NCC Group (2022-07-13) analysed an Everest ransomware binary recovered during incident response and assessed with medium confidence that Everest is related to Black-Byte; the sample was C# whereas earlier Black-Byte samples were Go. The intrusion used access through an insecure external service, PowerShell and cmd execution, RDP lateral movement, remote access tools installed as services (AnyDesk, Splashtop, Atera), ProcDump against LSASS, NTDS.dit copying, SoftPerfect network scanning, WinRAR archiving, Cobalt Strike over HTTPS plus a Metasploit payload, and exfiltration through Splashtop file transfer before encryption. HHS HC3 (August 2024, relayed by AHA) describes Everest as increasingly targeting healthcare, gaining access through compromised user accounts and common remote access tools, and using Cobalt Strike. AttackIQ (2026-07-02) analysed a per-victim, ConfuserEx-protected .NET 4.0 sample that declares AES-256 and RSA-4096 but effectively uses AES-128-CBC and RSA-1024, skips hosts with CIS locales, stops security services, deletes shadow copies and backups, encrypts to the .everest extension and drops _EVERESTRANSOMWARE.txt. AttackIQ notes the claimed 1 TB theft was not backed by exfiltration code in the binary and that hashes and artifacts may vary across deployments.

BeaconBeagle correlation for the three network IOCs (3.22.79.23, 18.193.71.144, 45.84.0.164) was attempted but the API returned HTTP 502 on two attempts, so no C2 correlation result is recorded. These IPs come from a 2022 incident and are likely stale. Nothing in this record should be read as confirming a compromise, a victim identity or encryption activity for the 2026-11-13 listing.

## MITRE ATT&CK

- T1133 External Remote Services
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1543.003 Create or Modify System Process: Windows Service
- T1070.004 Indicator Removal: File Deletion
- T1480.001 Execution Guardrails: Environmental Keying
- T1027 Obfuscated Files or Information
- T1003.001 OS Credential Dumping: LSASS Memory
- T1003.003 OS Credential Dumping: NTDS
- T1046 Network Service Discovery
- T1021.001 Remote Services: Remote Desktop Protocol
- T1021.002 Remote Services: SMB/Windows Admin Shares
- T1560.001 Archive Collected Data: Archive via Utility
- T1071.001 Application Layer Protocol: Web Protocols
- T1219 Remote Access Tools
- T1490 Inhibit System Recovery
- T1489 Service Stop

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Everest Ransomware — LSASS Dumping with ProcDump and NTDS.dit Copy** (`TL-2026-6006-SPL-002`)

Detects ProcDump (procdump64.exe -ma lsass.exe) and comsvcs MiniDump against LSASS, ntdsutil IFM or volume-shadow-copy extraction, and any command line touching ntds.dit / ntds.dit.zip, as used in the NCC Group Everest incident to harvest domain credentials before encryption. Also alerts on ProcDump opening LSASS (Sysmon EventCode 10).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1003.001, T1003.003
- **Data sources:** sysmon, windows_process_creation
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" ((EventCode=1 ((CommandLine="*procdump*" AND CommandLine="*lsass*") OR (CommandLine="*comsvcs*" AND CommandLine="*MiniDump*") OR (CommandLine="*ntdsutil*" AND CommandLine="*ifm*") OR CommandLine="*ntds.dit*" OR (CommandLine="*vssadmin*" AND CommandLine="*create shadow*"))) OR (EventCode=10 TargetImage="*lsass.exe" SourceImage="*procdump*")) | eval proc=coalesce(Image,SourceImage), acct=coalesce(User,SourceUser), detail=coalesce(CommandLine,TargetImage) | eval tl_technique=if(like(detail,"%ntds%") OR like(detail,"%shadow%") OR like(detail,"%ifm%"),"T1003.003","T1003.001") | stats count min(_time) as first_seen max(_time) as last_seen values(detail) as details values(tl_technique) as technique by host, acct, proc | convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (ProcessCommandLine has "procdump" and ProcessCommandLine has "lsass")
    or (ProcessCommandLine has "comsvcs" and ProcessCommandLine has "MiniDump")
    or (ProcessCommandLine has "ntdsutil" and ProcessCommandLine has "ifm")
    or ProcessCommandLine has "ntds.dit"
    or (ProcessCommandLine has "vssadmin" and ProcessCommandLine has "create shadow")
| extend Technique = iff(ProcessCommandLine has_any ("ntds","shadow","ifm"), "T1003.003", "T1003.001")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, Technique
| order by Timestamp desc
```

### Sigma

```yaml
title: Everest Ransomware Credential Dumping - ProcDump LSASS and NTDS.dit Extraction
id: 9b4d7e20-1c63-4f8a-b5a9-2e7d3c18f402
status: experimental
description: Detects ProcDump or comsvcs MiniDump against LSASS and ntdsutil, shadow-copy or direct ntds.dit extraction, matching the Everest ransomware intrusion documented by NCC Group.
references:
    - https://www.nccgroup.com/research/climbing-mount-everest-black-byte-bytes-back/
author: Threadlinqs Team
date: 2026/11/13
tags:
    - attack.credential_access
    - attack.t1003.001
    - attack.t1003.003
logsource:
    category: process_creation
    product: windows
detection:
    selection_procdump:
        CommandLine|contains|all:
            - 'procdump'
            - 'lsass'
    selection_comsvcs:
        CommandLine|contains|all:
            - 'comsvcs'
            - 'MiniDump'
    selection_ntdsutil:
        CommandLine|contains|all:
            - 'ntdsutil'
            - 'ifm'
    selection_ntds:
        CommandLine|contains: 'ntds.dit'
    selection_vss:
        CommandLine|contains|all:
            - 'vssadmin'
            - 'create shadow'
    condition: 1 of selection_*
falsepositives:
    - Authorised incident response or red-team credential-dumping exercises
    - Backup or AD maintenance tooling that references ntds.dit
level: critical
```

**Known false positives:**

- Authorised IR or red-team credential-dumping exercises
- AD backup or maintenance tooling that references ntds.dit

**Tuning notes:** Exclude domain-controller backup service accounts and approved IR hosts. Pair with Sysmon EventCode 10 (LSASS access) telemetry for coverage that does not depend on command-line text; the SPL already includes the ProcDump-to-LSASS access branch.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Everest Ransomware — External Remote Desktop Logon from Public IP (Initial Access / RDP) (locked: unlock with TL Creds)
- Everest Ransomware — SoftPerfect NetScan Discovery and WinRAR Data Staging (locked: unlock with TL Creds)
- Everest Ransomware — SMB Admin Share Lateral Movement Fan-Out (locked: unlock with TL Creds)
- Everest Ransomware — Unapproved RMM Tool (AnyDesk, Splashtop, Atera) Installed as a Service (locked: unlock with TL Creds)
- Everest Ransomware — Inhibit System Recovery, Backup Service Stop and Self-Deletion (locked: unlock with TL Creds)
- Everest Ransomware — Ransom Note, [indicator] Encrypted Files and Known Sample Artifacts (locked: unlock with TL Creds)
- Everest Ransomware — PowerShell/Cmd Download Cradle Staging Cobalt Strike or Metasploit Payload (locked: unlock with TL Creds)
- Everest Ransomware — Cobalt Strike / Meterpreter C2 Beaconing to Known Infrastructure and Port 10443 (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 26)

Defanged, TLP:CLEAR.

- IP address: `3.22.79[.]23`
- Domain: `everestndkvzcibcje2cqxhre2hmmybl3rn2gwzwsblz7gx6uryn5rad[.]onion`
- File hash: `1df92bf4c967297d8a39fc3f619a56702ee96d5cf9196b8e1d5b3654746c6514`

Full set of 26 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [ransomware.live victim listing: Final Notice Before Publication (Everest)](https://www.ransomware.live/id/RmluYWwgTm90aWNlIEJlZm9yZSBQdWJsaWNhdGlvbkBldmVyZXN0)
- [ransomware.live Everest group profile](https://www.ransomware.live/group/everest)
- [NCC Group / Fox-IT: Climbing Mount Everest - Black-Byte bytes back](https://www.nccgroup.com/research/climbing-mount-everest-black-byte-bytes-back/)
- [Searchlight Cyber: Ransomware Spotlight - Everest group increases initial access broker activity](https://slcyber.io/blog/everest-ransomware-group-increases-initial-access-broker-activity/)
- [AHA: HHS alerts health sector to Everest ransomware group threat (HC3 profile)](https://www.aha.org/news/headline/2024-08-21-hhs-alerts-health-sector-cyberthreat-everest-ransomware-group)
- [AHA: HC3 TLP:CLEAR threat actor profile - Everest ransomware group](https://www.aha.org/cybersecurity-government-intelligence-reports/2024-08-20-hc3-tlp-clear-threat-actor-profile-everest-ransomware-group-august-20)
- [AttackIQ: Everest ransomware analysis](https://www.attackiq.com/2026/07/02/everest-ransomware/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-6006