everest

Everest is a financially motivated ransomware and data-extortion group first observed in December 2020. Operators typically steal data and combine encryption with threats to publish stolen files if a cryptocurrency ransom is not paid. Vendor reporting describes opportunistic targeting across many countries and sectors, with initial access often tied to exposed remote access, stolen credentials, or unpatched internet-facing systems. The brand was still posting as of 2026-10-06: this dashboard recorded 5 claimed victims in 7 days, 11 in 30 days, and 45 in 90 days (45 listings since 2026-07-30). Recent named listings include Flydubai, Kennametal, Securitas Group, CENELEC, UNIRITA, and Morula IVF; a listing is a claim, not confirmation of payment or of an independently verified intrusion.