everest
ransomware group · aka Everest, EVEREST, Everest ransomware group · unknown · active since late 2024, per public ransomware trackers and vendor research (Cyberint/Check Point described it as newly emerged in early-2025 reporting); exact first-seen date unknown
Victims · 7d
0▼4
Victims · 30d
12active targets
Victims · 90d
34
All-time (tracked)
503since 2021-09-09
Last post
09-07 17:26UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
Everest is a ransomware and data-extortion group that emerged in late 2024 and operates as a ransomware-as-a-service (RaaS) brand, reportedly recruiting affiliates on underground forums including RAMP, per Cyberint/Check Point research (2025). It uses double extortion - stealing data and encrypting systems - and is notable for publicly marketing a 'no-leak' pledge, claiming it deletes stolen data and provides proof of deletion after payment rather than reselling or publishing it (vendor reporting, 2025). The group runs a Tor leak site where it names victims; attribution and national origin remain unknown, and no law-enforcement action against it has been publicly announced. Dashboard tracking shows low-volume, intermittent leak-site activity: 4 posts total since 2026-09-04, most recently 2026-09-07. Everest was cited in 2025-26 regional threat coverage discussing Qatar's threat landscape, and it should not be confused with a distinct older Everest-named file-encrypting strain documented around 2020.
Tactics & tooling
- Double extortion: exfiltrates victim data and deploys encryption, threatening publication on its Tor leak site
- RaaS model: advertises for affiliates on underground forums, including RAMP, per Cyberint/Check Point research (2025); affiliate infrastructure attribution largely unknown
- 'No-leak' payment pledge: publicly claims stolen data will be deleted, with proof of deletion provided after ransom payment, rather than leaked or resold (per Cyberint/Check Point, 2025)
- Victim shaming via leak-site posts naming targeted organizations; observed posting cadence is low-volume and intermittent (dashboard tracking, 2026)
- Initial-access tradecraft not comprehensively documented in public reporting; no specific CVE exploitation or access-broker purchases publicly confirmed - unknown as of the dashboard period
Targeted sectors
manufacturing/engineeringtechnologylife sciences/biotech
Notable public victims
Koerber (KUERBER) - German international technology/engineering group, publicly listed on Everest's leak site per dashboard tracking (September 2026), GGS - publicly named on Everest's leak site per dashboard tracking; sector and details unknown, GeneSilico - publicly named on Everest's leak site per dashboard tracking; life-sciences/biotech; details unknown, Negotiation Rules - listed by this dashboard among recent posts; likely the group's posted negotiation-rules entry rather than a victim organization, a common leak-site practice - unconfirmed
Estimated earnings
No public figure.
Leak-site victims503 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| GGS | · 8d ago | 2 posts - 1h |
| KÖRBER | · 8d ago | 2 posts - 1h |
| GENESILICO | · 8d ago | 2 posts - 1h |
| Negotiation Rules | · 11d ago | 1 posts - 1h |
| Rise UP | · 14d ago | 2 posts - 1h |
| VIVOTEK | · 14d ago | 2 posts - 1h |
| Italtel Peru | · 14d ago | 2 posts - 1h |
| CCA Bank | · 26d ago | 2 posts - 1h |
| Capgemini Engineering | · 26d ago | 2 posts - 1h |
| Grupo DT | · 26d ago | 2 posts - 1h |
| Kingston Technology | · 26d ago | 2 posts - 1h |
| Experts Entreprendre | · 26d ago | 2 posts - 1h |
| Keysight | · Aug 5, 2026 | 2 posts - 1h |
| EPM | · Jul 30, 2026 | 2 posts - Jul 6 |
| AKM Enterprises INC | · Jul 30, 2026 | 1 posts - Jun 10 |
| Formulatrix | · Jul 30, 2026 | 2 posts - Jul 6 |
| Oasis Legal Group | · Jul 30, 2026 | 2 posts - Jul 6 |
| Conway Analytics | · Jul 30, 2026 | 3 posts - Jul 7 |
| Greenbotz | · Jul 30, 2026 | 2 posts - Jul 7 |
| NIMR Oil | · Jul 30, 2026 | 2 posts - Jul 9 |
| TechCorr | · Jul 30, 2026 | 2 posts - Jul 9 |
| Rodschinson Investment | · Jul 30, 2026 | 2 posts - Jul 12 |
| Allied Telesis | · Jul 30, 2026 | 2 posts - Jul 17 |
| Dharma Group | · Jul 30, 2026 | 2 posts - Jul 17 |
| Emirates Flight Catering | · Jul 30, 2026 | 2 posts - Jul 17 |
| Alzone Software | · Jul 30, 2026 | 2 posts - Jul 18 |
| Rx Networks | · Jul 30, 2026 | 2 posts - Jul 21 |
| Al-Futtaim Group | · Jul 30, 2026 | 2 posts - Jul 21 |
| Aptara | · Jul 30, 2026 | 2 posts - Jul 22 |
| Ingersoll Rand | · Jul 30, 2026 | 2 posts - Jul 22 |
| Omnicell | · Jul 30, 2026 | 2 posts - Jul 22 |
| Powerweave | · Jul 30, 2026 | 2 posts - 6d |
| Mansfield Family Dentistry | · Jul 30, 2026 | 2 posts - 6d |
| Stadler Rail | · Jul 30, 2026 | 2 posts - yesterday |
| ЕРМ | · May 29, 2026 | — |
| Asopagos S.A. | · May 29, 2026 | — |
| Spedition Kern | · May 28, 2026 | — |
| Advanced Psychiatry Associates | · May 28, 2026 | — |
| Sidra Kuwait Hospital | · May 28, 2026 | — |
| VVO Finance | · May 28, 2026 | — |
| AKM | · May 28, 2026 | — |
| L&P Aesthetics | · May 28, 2026 | — |
| TransferZ | · May 28, 2026 | — |
| Citizens Bank - Database Leaked | · May 13, 2026 | — |
| Studio Marchi - Studio Professionale Associato - Database Leaked | · May 12, 2026 | — |
| Evaluate a Norstella company - Database Leaked | · May 12, 2026 | — |
| Rehab Clinics Group Ltd | · May 7, 2026 | — |
| K Subsea Group - Database Leaked | · May 7, 2026 | — |
| Tokoparts - Database Leaked | · May 7, 2026 | — |
| Super AI - Database Leaked | · May 7, 2026 | — |
In the newsAll →
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .