everest
ransomware group · aka Everest, EVEREST, Everest ransomware group · unknown · active since late 2024, per public ransomware trackers and vendor research (Cyberint/Check Point described it as newly emerged in early-2025 reporting); exact first-seen date unknown
Victims · 7d
0▼4
Victims · 30d
12active targets
Victims · 90d
34
All-time (tracked)
503since 2021-09-09
Last post
09-07 17:26UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
Everest is a ransomware and data-extortion group that emerged in late 2024 and operates as a ransomware-as-a-service (RaaS) brand, reportedly recruiting affiliates on underground forums including RAMP, per Cyberint/Check Point research (2025). It uses double extortion - stealing data and encrypting systems - and is notable for publicly marketing a 'no-leak' pledge, claiming it deletes stolen data and provides proof of deletion after payment rather than reselling or publishing it (vendor reporting, 2025). The group runs a Tor leak site where it names victims; attribution and national origin remain unknown, and no law-enforcement action against it has been publicly announced. Dashboard tracking shows low-volume, intermittent leak-site activity: 4 posts total since 2026-09-04, most recently 2026-09-07. Everest was cited in 2025-26 regional threat coverage discussing Qatar's threat landscape, and it should not be confused with a distinct older Everest-named file-encrypting strain documented around 2020.
Tactics & tooling
- Double extortion: exfiltrates victim data and deploys encryption, threatening publication on its Tor leak site
- RaaS model: advertises for affiliates on underground forums, including RAMP, per Cyberint/Check Point research (2025); affiliate infrastructure attribution largely unknown
- 'No-leak' payment pledge: publicly claims stolen data will be deleted, with proof of deletion provided after ransom payment, rather than leaked or resold (per Cyberint/Check Point, 2025)
- Victim shaming via leak-site posts naming targeted organizations; observed posting cadence is low-volume and intermittent (dashboard tracking, 2026)
- Initial-access tradecraft not comprehensively documented in public reporting; no specific CVE exploitation or access-broker purchases publicly confirmed - unknown as of the dashboard period
Targeted sectors
manufacturing/engineeringtechnologylife sciences/biotech
Notable public victims
Koerber (KUERBER) - German international technology/engineering group, publicly listed on Everest's leak site per dashboard tracking (September 2026), GGS - publicly named on Everest's leak site per dashboard tracking; sector and details unknown, GeneSilico - publicly named on Everest's leak site per dashboard tracking; life-sciences/biotech; details unknown, Negotiation Rules - listed by this dashboard among recent posts; likely the group's posted negotiation-rules entry rather than a victim organization, a common leak-site practice - unconfirmed
Estimated earnings
No public figure.
Leak-site victims503 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| Country Inn & Suites by Radisson Data Leak | · Nov 1, 2024 | https://gofile.io/d/jqQPwK Thousands and thousands of client’s personal information,credit cards info, internal emails, incidents, messagesFull calendar of past and future bookings Title Last Name First Name Arrival Departure Nights Adults/Children Rate PlanPackage Room Number Room Type Special Request Guest Information AddressCity State Country Postal Code Phone E-mail Guest Tax ID Rewards Progra Billing InformationTax Exempt Guarantee/Payment […] |
| Aspen Healthcare Data Leak | · Nov 1, 2024 | https://gofile.io/d/O4wIHm https://aspenhealthcareservices.com |
| Arctrade | · Nov 1, 2024 | Time to resolve : More than 40,000 customers info and other internal data https://arctrade.com ISO, State,LDC,Load Zone,Customer,LDC Acct ID #,Account Group,Is Special Needs,Is Switch Hold,Customer Added Date,Last Upload Date,Current Status,Current Status Change Date,Latest EDI Date,Contract Approval Date,Contract Status,Legal Document Language,Contract,Deal Type,Fixed Rate (MWh),Broker Fee Rate (MWh),Original Contract Begin,Original Contract End,Actual Contract Begin,Actual Contract End,Renewal Contract […] |
| Spine by Villamil MD | · Oct 25, 2024 | More than 1000 medical data of the company’s patients https://spinebyvillamilmd.com/ Time until publication: |
| Aspen Healthcare | · Oct 25, 2024 | More than 1500 Medical Records and Personal Information https://aspenhealthcareservices.com Time until publication: |
| Pacific Pulmonary Medical Group | · Oct 25, 2024 | Medical records and personal data of all patients from 2021 Company representative should follow the instructions to contact us before time runs out https://pacificpulm.com/ |
| Country Inn & Suites by Radisson | · Oct 19, 2024 | Thousands and thousands of client’s personal information,credit cards info, internal emails, incidents, messagesFull calendar of past and future bookingsAnd complete negligence in storing passwords and private data, Evidences that management is aware of events and is not taking any actionThe company must follow the instructions to resolve the issue with us before the timer ends, […] |
| CreaGen Inc | · Oct 18, 2024 | Research data and other internal documents,contracts ,laboratory tests https://creageninc.com Time to resolve : |
| Broward Realty Corp | · Oct 7, 2024 | Company must contact and resolve the issue by the end of October 21 or all data will be published 2972 NW 60th St, Fort Lauderdale FL 33309Phone 954-645-7020 & 954-645-7733 Marylou Adams [email protected] 954-444-6626George Weaver [email protected] 954-806-3268Zsa-Zsa Weaver [email protected] 754-215-9533 |
| Pureform Radiology Center | · Sep 23, 2024 | We were able to hack into the Pureform Radiology Center in Canada.All medical records, internal documents were stolen. But the most valuable thing we found was a zero-day exploit in the software of the company that acquired Pureform. Pureform’s president hired a recovery negotiator, unaware that he was dealing with a complete amateur who was […] |
| Mitsubishi Chemical Group pt.2 | · Sep 17, 2024 | Full file tree:https://gofile.io/d/13CXPPSamples:https://gofile.io/d/wTv9Ot 19 GB Strictly one-handed saleBuyer will not be revealed |
| MCNA Dental 1 million patients records | · Sep 16, 2024 | Company has the last 24 hours to contact us using the instructions left.In case of silence, all data will be published More than 1 million personal EMR’s + different internal company documents https://www.mcna.net/ Example :5511310,NICOLE M GARCIA,2901 BAYARD ST,LAREDO, TX 78046,12/07/2005,(956) 949-0951,4174985,526285913,MATTHEW A STAAT,3768,MCNA,Eligible,2019-01-08 00:00:00,2018-11-20 00:00:00,2019-01-08 00:00:00,2016-07-26 00:00:00,2016-07-26 00:00:00,4. 1 Year +,NULL,2021-06-02,Active,648,$25.00,$564.00,$0.00,TEXAS CHIP,NICOLE,M,GARCIA,2901 BAYARD ST,,LAREDO,TX,78046 […] |
| NIDEC CORPORATION Data Leak | · Sep 7, 2024 | https://gofile.io/d/LVvexa https://nidec.com |
| Mitsubishi Chemical Group | · Aug 31, 2024 | Since Mitsubishi Chemicals think that this situation doesn’t bother them much and are more worried about the earthquake 6 terabytes of internal data containing drawings, developments, contracts. Also information about incidents within the companyTo contact us, use e-mail [email protected], then you will receive all further points after we understand that you are seriously interested. Strictly […] |
| NIDEC CORPORATION pt.2 | · Aug 9, 2024 | Sample: https://gofile.io/d/wxUSVe https://nidec.com |
| Gramercy Surgery Center Data Leak | · Aug 8, 2024 | https://gofile.io/d/BBnhE0https://gofile.io/d/SiepkHhttps://gofile.io/d/vaTlrbhttps://gofile.io/d/RVdzOChttps://gofile.io/d/dDuOi7https://gofile.io/d/d9QC7Ahttps://gofile.io/d/NVK1Xvhttps://gofile.io/d/8hx1mW https://gramercysurgery.com |
| Horizon View Medical Center | · Aug 8, 2024 | Company has the last 24 hours to contact us using the instructions left.In case of silence, all data will be published https://horizonviewmed.com(702) 641-85006170 N Durango Dr Ste 220 Las Vegas, NV 89149 |
| NIDEC CORPORATION | · Aug 8, 2024 | Company has the last 24 hours to contact us using the instructions left.In case of silence, all data will be published https://www.nidec.com |
| Speed Advisory Data Leak | · Aug 5, 2024 | https://gofile.io/d/mujlllhttps://gofile.io/d/0p6NpK https://www.speedadvisors.comhttps://hubercpas.comhttps://dspeedcpa.com |
| STUDIO NOTARILE BUCCI – OLMI Data Leak | · Jul 26, 2024 | https://gofile.io/d/6KNoc7https://gofile.io/d/48K5KI https://studionotarilebucciolmi.it |
| Speed Advisory | · Jul 26, 2024 | Company has the last 24 hours to contact us using the instructions left.In case of silence, all data will be publishedTotal amount of stolen data : 150 GB https://www.speedadvisors.com/https://hubercpas.comhttps://dspeedcpa.com |
| The Law Office of Omar O. Vargas, P.C. Data Leak | · Jul 25, 2024 | https://gofile.io/d/YUV6KC criminal1https://gofile.io/d/X2pXpz criminal2https://gofile.io/d/kGpN5Z familyhttps://gofile.io/d/iUo8Kp immigrationhttps://gofile.io/d/dqtRhN https://www.quenotedeporten.com |
| SH Pension Data Leak | · Jul 25, 2024 | https://gofile.io/d/0YaihX https://www.shpension.se/ |
| SH Pension | · Jul 22, 2024 | Company has the last 24 hours to contact us using the instructions left.In case of silence, all data will be publishedTotal amount of stolen data : 100 GBhttps://www.shpension.se/ |
| The Law Office of Omar O. Vargas, P.C. | · Jul 17, 2024 | Company must contact us using the instructions in next 3 days. Total amount of stolen data: 450 GB https://www.quenotedeporten.com |
| STUDIO NOTARILE BUCCI – OLMI | · Jul 17, 2024 | Company must contact us using the instructions in next 3 days. Total amount of stolen data: 400 GB https://studionotarilebucciolmi.it |
| Gramercy Surgery Center | · Jul 15, 2024 | Company has the last 24 hours to return to the chatTotal amount of stolen data : 465 GBhttps://gramercysurgery.com |
| Cukierski & Associates, LLC Data Leak | · Jun 26, 2024 | https://gofile.io/d/cxZnja https://cukierski.cpa/ |
| 2K Dental Data Leak | · Jun 25, 2024 | 1700+ medical recordshttps://gofile.io/d/bV0SFMhttps://www.2kdental.com/ |
| Diogenet S.r.l. Data Leak | · Jun 25, 2024 | 115 GBhttps://gofile.io/d/vzyOoOhttps://gofile.io/d/qLcieahttps://www.diogenet.it/ |
| Zuber Gardner CPAs Data Leak | · Jun 14, 2024 | 155 GBhttps://gofile.io/d/SIK5J6https://gofile.io/d/q9h7mPhttps://gofile.io/d/lAjWiI https://www.zubergardner.com |
| 2K Dental | · Jun 13, 2024 | Company has the last 48 hours to contact us using the instructions left.In case of silence, all data will be published and clients notifiedhttps://www.2kdental.com/ |
| Cukierski & Associates, LLC | · Jun 13, 2024 | The company has 24 hours to contact us or the files will be published and clients notifiedhttps://cukierski.cpa |
| Diogenet S.r.l. | · Jun 13, 2024 | Company has the last 48 hours to contact us using the instructions left.In case of silence, all data will be published and clients notifiedTotal amount of stolen data : 115 GBhttps://www.diogenet.it/ |
| Zuber Gardner CPAs pt.2 | · Jun 11, 2024 | The company’s files are still on our servers and it is stupid to think that they are not there.The company has 24 hours to contact us or the files will be published and clients notifiedhttps://www.zubergardner.com https://gofile.io/d/PG1SoN 1GB |
| Voorhees Family Office Services | · Jun 4, 2024 | Company has the last 24 hours to contact us using the instructions left.In case of silence, all data will be publishedTotal amount of stolen data : 600 GBhttps://www.vfos.com/ |
| Wealth Depot LLC Data Leak | · Jun 2, 2024 | https://wealthdepotllc.sharefile.com/public/share/web-sae42dd0af27849ed8d1e166b6649c890 https://wealthdepotllc.sharefile.com/public/share/web-s92598d9f17c94dbb9b792fea451afb2f https://wealthdepotllc.sharefile.com/public/share/web-s0788f96bd7e443b3ab24f454d9ec9ec0 https://wealthdepotllc.sharefile.com/public/share/web-s63777696d1374d74a4bf4e828a91c699 ttps://wealthdepotllc.sharefile.com/public/share/web-sf3877fffe7034cd794cd71551194081f Clients F-P https://wealthdepotllc.sharefile.com/public/share/web-s485e55f413dc4534bbddda5abe8bd845 Clients Q-Z https://wealthdepotllc.sharefile.com/public/share/web-se778e5490aab4627922889c1bca1b91c Document processing https://wealthdepotllc.sharefile.com/public/share/web-s0616eff8859d4605858b9bddb17f4204 Ex Clients https://wealthdepotllc.sharefile.com/home/shared/fob18c5f-1c7c-4249-a4ee-afcfd51a7c03 |
| Ayoub & associates CPA Firm Data Leak | · Jun 2, 2024 | 465 GB https://gofile.io/d/hVPYRXhttps://gofile.io/d/YOiFExhttps://gofile.io/d/2VMOJDhttps://gofile.io/d/op6t7ahttps://gofile.io/d/GFJuAShttps://gofile.io/d/xK6Eyzhttps://gofile.io/d/bVLzi2https://gofile.io/d/x0SzEg https://ayoub-associates.com |
| Wealth Depot LLC | · May 15, 2024 | Company has the last 24 hours to contact us using the instructions left.In case of silence, all data will be publishedTotal amount of stolen data : 450 GBhttps://wealthdepot.com/ |
| Zuber Gardner CPAs | · May 9, 2024 | Company has the last 24 hours to contact us using the instructions left.In case of silence, all data will be publishedTotal amount of stolen data : 350 GBhttps://www.zubergardner.com |
| Corr & Corr | · May 9, 2024 | Company has the last 24 hours to contact us using the instructions left.In case of silence, all data will be publishedTotal amount of stolen data : 100 GBhttps://corrca.com |
| Accounting Professionals LLC. Price, Breazeale & Chastang | · May 4, 2024 | Company has the last 24 hours to contact us using the instructions left.In case of silence, all data will be publishedIncluding documents from over 2 thousands of your clientsTotal amount of stolen data : 574 GB https://accountingprofessionals.org/https://pbc-pa.com |
| Ayoub & associates CPA Firm | · May 2, 2024 | Company has the last 24 hours to contact us using the instructions left. In case of silence, all data will be publishedIncluding documents from over 2 thousands of your clientsTotal amount of stolen data : 465 GB ayoub-associates.com |
| Les Miroirs St-Antoine Inc Data Leak | · May 1, 2024 | 164 GBhttps://gofile.io/d/Ath8Yzhttps://gofile.io/d/p3wv95https://gofile.io/d/tzW88d https://miroirstantoine.com/ |
| MORTON WILLIAMS Data Leak | · May 1, 2024 | 150 GBhttps://gofile.io/d/mW8T5Uhttps://gofile.io/d/W1oksY https://www.mortonwilliams.com/ |
| Les Miroirs St-Antoine Inc | · Apr 25, 2024 | Company has the last 24 hours to contact us using the instructions left. In case of silence, all data will be published herehttps://miroirstantoine.com/ |
| Fincasrevuelta Data Leak | · Apr 2, 2024 | 38 GBhttps://www.fincasrevuelta.es/ https://gofile.io/d/7LIpPv |
| Crimsgroup Data Leak | · Apr 2, 2024 | 263 GBcrimsonenginc.com whitetailautomation.com scadahive.com herbert.com https://gofile.io/d/5e9bsshttps://gofile.io/d/qgGaRvhttps://gofile.io/d/h2Npd4https://gofile.io/d/eU4aGJ |
| Primeimaging Data Leak | · Mar 28, 2024 | 200 GB personal medical records, onco results, clients and employee personal data, passports and other documents https://primeimaging.com https://gofile.io/d/U0bWTihttps://gofile.io/d/oYHyYvhttps://gofile.io/d/utHvjxhttps://gofile.io/d/k4UHks |
| Crimsgroup | · Mar 26, 2024 | Company has the last 24 hours to contact us using the instructions left. In case of silence, all data will be published here |
In the newsAll →
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .