everest
ransomware group · aka Everest, EVEREST, Everest ransomware group · unknown · active since late 2024, per public ransomware trackers and vendor research (Cyberint/Check Point described it as newly emerged in early-2025 reporting); exact first-seen date unknown
Victims · 7d
0▼4
Victims · 30d
12active targets
Victims · 90d
34
All-time (tracked)
503since 2021-09-09
Last post
09-07 17:26UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
Everest is a ransomware and data-extortion group that emerged in late 2024 and operates as a ransomware-as-a-service (RaaS) brand, reportedly recruiting affiliates on underground forums including RAMP, per Cyberint/Check Point research (2025). It uses double extortion - stealing data and encrypting systems - and is notable for publicly marketing a 'no-leak' pledge, claiming it deletes stolen data and provides proof of deletion after payment rather than reselling or publishing it (vendor reporting, 2025). The group runs a Tor leak site where it names victims; attribution and national origin remain unknown, and no law-enforcement action against it has been publicly announced. Dashboard tracking shows low-volume, intermittent leak-site activity: 4 posts total since 2026-09-04, most recently 2026-09-07. Everest was cited in 2025-26 regional threat coverage discussing Qatar's threat landscape, and it should not be confused with a distinct older Everest-named file-encrypting strain documented around 2020.
Tactics & tooling
- Double extortion: exfiltrates victim data and deploys encryption, threatening publication on its Tor leak site
- RaaS model: advertises for affiliates on underground forums, including RAMP, per Cyberint/Check Point research (2025); affiliate infrastructure attribution largely unknown
- 'No-leak' payment pledge: publicly claims stolen data will be deleted, with proof of deletion provided after ransom payment, rather than leaked or resold (per Cyberint/Check Point, 2025)
- Victim shaming via leak-site posts naming targeted organizations; observed posting cadence is low-volume and intermittent (dashboard tracking, 2026)
- Initial-access tradecraft not comprehensively documented in public reporting; no specific CVE exploitation or access-broker purchases publicly confirmed - unknown as of the dashboard period
Targeted sectors
manufacturing/engineeringtechnologylife sciences/biotech
Notable public victims
Koerber (KUERBER) - German international technology/engineering group, publicly listed on Everest's leak site per dashboard tracking (September 2026), GGS - publicly named on Everest's leak site per dashboard tracking; sector and details unknown, GeneSilico - publicly named on Everest's leak site per dashboard tracking; life-sciences/biotech; details unknown, Negotiation Rules - listed by this dashboard among recent posts; likely the group's posted negotiation-rules entry rather than a victim organization, a common leak-site practice - unconfirmed
Estimated earnings
No public figure.
Leak-site victims503 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| Fincasrevuelta | · Mar 9, 2024 | Company has the last 24 hours to contact us using the instructions left. In case of silence, all data will be published here https://www.fincasrevuelta.es/ |
| Raocala | · Feb 20, 2024 | Company has the last 24 hours to contact us using the instructions left. In case of silence, all data will be published here https://raocala.com |
| Primeimaging database for sale | · Feb 1, 2024 | 1.8 Terabytes of company internal data for salePersonal medical records, onco results, clients and employee personal data, passports and other documents Price 20,000$ https://primeimaging.com |
| Alliedwoundcare | · Jan 12, 2024 | Company has the last 24 hours to contact us using the instructions left. In case of silence, all data will be published here https://alliedwoundcare.com |
| Primeimaging | · Jan 12, 2024 | Company has the last 24 hours to contact us using the instructions left. In case of silence, all data will be published here https://primeimaging.com |
| Full access to the school network USA | · Dec 4, 2023 | On sale access to the all school network.USA,state TXPasswords to the admin,network admin,students,directory,teachers and much more. Admin microsoftAzure portalDomain adminBackup serverDomain hosting,network company tox:A0E79CBC8D18DDA358665BEB91360B79CFCFD54040EAD197147F1EBAB92DC64D71909CA9E64C jabber:[email protected] [email protected] |
| Access to the large database of a US Medical organization | · Nov 7, 2023 | Available actions with patient data in the panelSearch, Edit, Print, DownloadThe base is replenished from different clinics, both public and privatehttps://www.srmcfl.comhttps://www.adventhealth.comhttps://www.advimg.comAnd many others Name DOB Gender SSN Address Home Phone Work PhoneSite MPI MRN Dept Num Patient Class Admitted Discharged Site Location Hospital Svc Point of CareFacility Building Room Bed Attending Referring Consulting Admitting Visit […] |
| We monetize your corporate access | · Oct 11, 2023 | Team looking for corporate accesses (shell,vnc, hvnc, rdp + vpn, teamviewer, anydesk etc.)Us Countries,Ca and Europe. A good percentage for partners, full transparency of work and confidentiality jabber:[email protected]@thesecure.biz email:[email protected]@cock.li |
| Agriloja.pt Full Leak | · Sep 18, 2023 | https://cloud.mail.ru/public/oAe6/ZfPMzZPwehttps://cloud.mail.ru/public/bLE1/ER3UPBi9Uhttps://cloud.mail.ru/public/xm59/WBf27NeNKhttps://cloud.mail.ru/public/AKZg/E5tw3gxhDhttps://cloud.mail.ru/public/CacU/12VBNB24Khttps://cloud.mail.ru/public/MpLj/K5kE7VJZchttps://cloud.mail.ru/public/yF12/XGd6tGSBehttps://cloud.mail.ru/public/GSyK/J6SVDyZxAhttps://cloud.mail.ru/public/1Ew9/m9PUuzTZmhttps://cloud.mail.ru/public/Zgk6/1FGxwV6tPhttps://cloud.mail.ru/public/BUDf/J7udioXHWhttps://cloud.mail.ru/public/7iFf/CnyaBkCmshttps://cloud.mail.ru/public/RUPe/Ubx1DENRQhttps://cloud.mail.ru/public/iN91/pLuzjttZfhttps://cloud.mail.ru/public/7wGE/qhkjwEmw7https://cloud.mail.ru/public/hiYo/jJFAdfV7Jhttps://cloud.mail.ru/public/D5e1/UCjQn5ebNhttps://cloud.mail.ru/public/TQch/zGrk6AHhuhttps://cloud.mail.ru/public/Hw6v/W61TLWzK7https://cloud.mail.ru/public/HC5v/ywcCXabXZhttps://cloud.mail.ru/public/aaDb/vBue6KzoPhttps://cloud.mail.ru/public/zada/pYKKsenJyhttps://cloud.mail.ru/public/Ju7z/ia79hAjdN |
| Cmranallolaw.com | · Sep 11, 2023 | -Confidential data of a law firm-Tax forms, dl, ssn etc.-Contracts-Personal data of clients-Financial documents-Internal correspondence and emails To fully delete these files, company representatives must contact by September 15, 2023.Otherwise, all this data will be published here and other forums,in the same way, the company’s customers will be notified and receive copies of their files |
| SKF.com | · Sep 2, 2023 | SKF’s network was compromised(by collaboration with Ransomed group) a few days ago. The company continues to be silent about the problem.A representative of the company should contact us immediately and get full picture of what happened, instructions have all been sended in the emails.Otherwise, we will start communicating with your competitors. Revenue : $8.1 Billions […] |
| Powersportsmarketing.com | · Sep 2, 2023 | PSM network was compromised(by collaboration with Ransomed group).Our group got 2.2 Tb of intertnal data.Inculduing 43,000 customer records. We already sent a message and there is no jokes. Data Stolen : 2.2 TerabytesData Info : Customer records,Customer InformationTime : Till 4.09.2023 |
| Statefarm.com | · Sep 2, 2023 | About 400,000,000 customer insurance records database was stolen from their network.No need to say anything moreWe are will wait for company representative until 05.09.2023 Otherwise all data will be sold to third parties |
| Agriloja pt.3 | · Aug 29, 2023 | New leakage 3 GB of internal documents .Company must stop ignore our calls and contact us in next 36 hrs.Full package of 1.2 TB uploading and will be published in case of silence.https://dropmefiles.com/Z4pIjPassword: 69hrZT |
| STUART OLSON INC. | · Aug 28, 2023 | Full documentation includes architecture, electricity, structure, security and more. S.W. Yorkson Elementary School Langley BC Grandview Heights Secondary School Company: STUART OLSON INC. Address: 600, 4820 Richard Road SW Calgary, AB T3E 6L1 Website: http://stuartolson.com Email: [email protected] Phone: 403.685.7777 Files: STUART OLSON INC Published data: 681mb |
| Traugott Building Contractors Inc. | · Aug 28, 2023 | Full documentation includes architecture, electricity, structure, security and more . Poirier Sport Complex (PSLC) Arena 3 Conversion – Phase 2, Coquitlam BC Capilano University Library Reno / Center for Student Success – Phase 2 Walmart 3042 Kelowna Relay City of Vancouver 2780 East Broadway Company: Traugott Building Contractors Inc. Address: 3740 11A Street NE, Unit 101BCalgary, Alberta T2E 6M6 Canada Website: http://traugott.com Email: [email protected] Phone: (403) 276-6444 Files: Traugott_Building_Contractors_Inc.zip Published data: 2 GB |
| Weir & Partners LLP | · Aug 28, 2023 | The company probably does not understand the whole seriousness of the situation. This is customer data, employee data and other very important documents. Company: Weir & Partners LLP Address: 1339 Chestnut Street, Suite 500Philadelphia, 19107 , United States Website: https://www.weirpartners.com Email: [email protected] Phone: 215-665-8181 Files: weirpartners.rar Published data: 2.4GB |
| Pomerleau | · Aug 28, 2023 | Full documentation includes architecture, electricity, structure, security and more. H.S Grenda Middle School Handsworth Secondary School Replacement Company: Pomerleau Address: 99 Airport Road, Suite 200St. Johns NL A1A 4Y3 Website: http://pomerleau.ca Email: [email protected] Phone: 709-739-5652 Files: pomerleau.zip Published data: 826 mb |
| EllisDon | · Aug 28, 2023 | Full documentation includes architecture, electricity, structure, security and more . Royal Columbian Hospital Phase 2 Company: EllisDon Address: 1004 Middlegate Rd. Suite 1000Mississauga, Ontario , 4Y1M4 , Canada Website: http://ellisdon.com Email: [email protected]@ellisdon.com Phone: 905-896-8900 Files: ellisdon.zip Published data: 3.14 GB |
| Leaks from various construction companies | · Aug 28, 2023 | Full documentation includes architecture, electricity, structure, security and more . Companies: Town Centre Park WashroomPlaza and Meadow ConstructionCanada Place L16-Stair RenewalPetco Animal Supplies Stores, INCTransLink Tire Storage BuildingWalmart 1119Regent Elementary School Files: various_building_companies |
| Oxford Properties Group | · Aug 28, 2023 | The company probably does not understand the whole seriousness of the situation. Full documentation includes architecture, electricity, structure, security and more. Amazon YVR-14 Riverbend Building Riverbend Multi-Storey Warehouse Company: Oxford Properties Group Address: EY Tower, 100 Adelaide Street West, Suite 2100 Toronto, Ontario , Canada M5H 0E2 Website: http://www.oxfordproperties.com Email: [email protected]@oxfordproperties.com Phone: +1 416 865 8300 Files: oxfordproperties.zip Published data: 821mb |
| SwissReal Group | · Aug 28, 2023 | Full documentation includes demolition electrical plan,cable tray elevation,electrical room demolition plan,security camera and much more 475 Howe Street – Amazon YVR20ERA Maple Ridge Development Company: SwissReal Group Address: 1510 – 475 Howe StreetVancouver, BC, V6C 2B3 Website: https://www.swissreal.com Email: [email protected]@[email protected] Phone: (604) 688-5311 Files: swissreal.zip Published data: 1.02GB |
| Dawson Wallace | · Aug 28, 2023 | Full documentation includes demolition electrical plan,cable tray elevation,electrical room demolition plan,security camera and much more OpenRoad Mercedes Benz Port Hardy Oceans Depot Valleyview Secondary School Expansion OpenRoad Honda Quesnel Junior School Pexsisen & Centre Mountain Lellum Schools Sooke Library Cranbrook Kia Addition Nanaimo Fire Station Company: Dawson Wallace Address: 4611 Eleniak Road NWEdmonton, AB, T6B 2N1 , CANADA Website: http://www.dawsonwallace.com/ Email: [email protected]@dawsonwallace.com Phone: 780-466-8700 Files: dawsonwallace.zip Published data: 3.74 GB |
| Clarkbuilders | · Aug 28, 2023 | Full documentation includes demolition electrical plan,cable tray elevation,electrical room demolition plan,security camera and much more Dominion Diamond Sort House ProjectDominion Diamond DPRT Truck ShopMaddaugh Road Elementary SchoolSD39 – Vancouver School Board FutureBMO – No.3 & CapstanHolly & Greenaway Elementary Schools Seismic UpgradesVRS Rental HousingDouglas Area ElementaryMaple Grove Elementary SchoolCoquitlam Transfer StationEdith Cavell Elementary School Seismic […] |
| Gershon Biegeleisen & Co | · Aug 28, 2023 | This is customer data, employee data, tax refund and other very important documents Tax forms : https://dropmefiles.com/jzzFn Tax pwd : 08701 Publication date all archives: March 6 ,2021 Company: Gershon Biegeleisen & Co Address: 111 Madison Ave, Lakewood, NJ , 08701 Website: http://gbcpas.com Email: [email protected] Phone: 7328866311 Files: [email protected]: https://dropmefiles.com.ua/en/[email protected]: https://dropmefiles.com.ua/en/[email protected] part2: https://dropmefiles.com.ua/en/[email protected]: https://dropmefiles.com.ua/en/[email protected]: https://dropmefiles.com.ua/en/[email protected]: […] |
| Backus, Meyer & Branch, LLP | · Aug 28, 2023 | This is customer data, employee data and other very important documents Publication date: March 13 ,2021 Company: Backus, Meyer & Branch, LLP Address: 116 Lowell Street , Manchester, NH 03104 Website: https://www.backusmeyer.com/ Email: [email protected] Phone: 603-244-3282 Files: https://dropmefiles.com.ua/en/khe8PMfDUpwd 123456789 Published data: 11.2 GB |
| Greenberg & Stein New York City Personal Injury Lawyers | · Aug 28, 2023 | This is customer data, employee data and other very important documents Publication date: March 13 ,2021 Company: Greenberg & Stein New York City Personal Injury Lawyers Address: 360 Lexington Avenue Suite 1501 New York, NY 10017 Website: https://greenbergandstein.com Email: [email protected] Phone: 212-969-8770 Files: https://dropmefiles.com.ua/en/Dzf4wTeCpwd 123456789 Published data: 1.7GB |
| Law Offices of Brandon Sua & Associates | · Aug 28, 2023 | This is customer data, employee data and other very important documents Company: Law Offices of Brandon Sua & Associates Address: 5756 E Los Angeles Ave Simi Valley, CA 93063 Website: https://www.lastopattorneys.com/ Email: [email protected]@[email protected]@[email protected]@[email protected]@[email protected]@[email protected]@[email protected]@[email protected]@[email protected]@[email protected]@[email protected] Phone: (805) 261-4552 Files: https://dropmefiles.com.ua/en/HAzC4UGVR Published data: 725 mb |
| Agriloja.pt demo-leak | · Aug 17, 2023 | 100 random personal records (from 1400+). Company must contact us in next 24 hrs. Otherwise more personal data will be published in the blog and darknet forums. Download: https://dropmefiles.com/L8kHr https://dropmefiles.com.ua/ua/vKTzPassword: 123 |
| Agriloja.pt | · Aug 14, 2023 | 464574 internal documents and files stolen.1.2 TBSQL DBs, Email Archives, Personal information,employee data,,IDs,various company documents… To restore damaged system and prevent data from publication company’s representative should contact us in next 72 hrs. Full filetree can be provided as a proof. |
| ZESA Holdings | · Aug 8, 2023 | Today, the servers of the entire infrastructure of ZESA HOLDINGS (90% Country Electricity Manufacture ) were attacked, including divisionsZETDCZENTPowertelICS, IPMP, Smartvend ,various oracle servers, big part of backups were also attacked.Terabytes of internal (and interesting) data has been exfiltrated to our servers Internal financial data (Including WorldBank’s data and Indian Bank transactions and documents) Various […] |
| Kovair Software Data Leak | · Aug 5, 2023 | The set dates are out, so we post the entire archive Part1 https://dropmefiles.com/3GRYpPart2 https://dropmefiles.com/nAayAPart3 https://dropmefiles.com/tmhIhPart4 https://dropmefiles.com/K5zYzPart5 https://dropmefiles.com/6rp1UPart6 https://dropmefiles.com/5j6VM Password: &#B”a3Arcj}eOfoQ==Fh |
| Great Opportunity to monetize your corporate access | · Aug 1, 2023 | Team looking for new partners with access to corporate networks.Fast work, good share. The offer will close on August 7. First come first served jabber:[email protected]@thesecure.biz email:[email protected]@cock.li |
| Kovair Software | · Jul 26, 2023 | 200 GB of internal files (Kovair.com) were stolen from the company’s servers. The files contain:– Project Source Codes– Personal data of employees– Various internal work documents To fully restore the system and delete these files, company representatives must contact by August 3, 2023.Otherwise, all this data will be published here and other forums,in the same […] |
| Looking for new partners | · Jun 26, 2023 | In the next few days looking for new partners with access to corporate networks.Fast work, good share, as well as confidentiality if you need it.Contact us through our website email. |
| US District Court / Law company | · Apr 27, 2023 | On sale access to the network US District CourtEmployee access,full controlAV: NoNetwork access of a lawyer with tons various confidential documents is included in this sale. Internal correspondence,tax,banks,ssn,dl,court cases. State IL.Price 15,000$Payment: btc,xmrContact email: [email protected] or jabber: [email protected],[email protected] |
| MultiCareInc pt.2 | · Apr 26, 2023 | The company stopped contacting us, believing that their customer data is not something to worry about.As promised new dataClients and their relatives will certainly be happy with this fact |
| US District Court IL / On sale | · Apr 19, 2023 | On sale access to the network US District Court Employee access,full control AV: No Network access of a lawyer with tons various confidential documents is included in this sale Contact email: [email protected] or jabber: [email protected],[email protected] |
| US District Court / On sale | · Apr 19, 2023 | On sale access to the network US District Court Employee access,full control AV: No Network access of a lawyer with tons various confidential documents is included in this sale Contact email: [email protected] or jabber: [email protected],[email protected] |
| US District Court | · Mar 22, 2023 | On sale access to the network US District Court Contact email or jabber: [email protected] |
| NRG Innovations DataBase Leak | · Mar 15, 2023 | Includes internal correspondence,financial documents,tax documents,accounting,SSN,DLThe owners of the company were notified of the incident in person and of the time frame.Download:https://dropmefiles.com.ua/ua/Z4aW2https://dropmefiles.com.ua/ua/YEhZXwkmK site pwd 868274903rar pwd 8392GLDKLA82@ |
| Aeronautics company Canada | UTC Aerospace Systems, Bombardier, NASA partners | · Jan 3, 2023 | Corporate email access is on saleManufacturing company Partners of this company:UTC Aerospace SystemsBombardier aerospaceNASASpirit AerosystemsAnd other Partners from many countries. Canada,USA,UK Production of parts for aircraft engines Production of parts for the world’s leaders Aeronautics Industry. Including the production of parts for aircraft engines. Great opportunity for further intelligence and receiving the сonfidential data, drawings, […] |
| Aeronautics company Canada / UTC Aerospace Systems, Bombardier aerospace, NASA partners | · Nov 23, 2022 | Corporate email access is on saleManufacturing company Partners of this company:UTC Aerospace SystemsBombardier aerospaceNASAAnd other Production of parts for the world’s leaders Aeronautics Industry. Including the production of parts for aircraft engines. Great opportunity for further intelligence and receiving the сonfidential data, drawings, development in the field of aircraft industry data Personal data of employees, […] |
| Aeronautics company Canada / UTC Aerospace Systems, Bombardier aerospace partners | · Nov 22, 2022 | Corporate email access is on saleManufacturing company Partners of this company:UTC Aerospace SystemsBombardier aerospaceNASAAnd other Production of parts for the world’s leaders Aeronautics Industry. Including the production of parts for aircraft engines. Great opportunity for further intelligence and receiving the сonfidential data, drawings, development in the field of aircraft industry data Personal data of employees, […] |
| Aeronautics company Canada / Production of parts for aircraft engines | · Nov 16, 2022 | Corporate email access is on saleManufacturing company Partners of this company:UTC Aerospace SystemsBombardier aerospaceAnd other Production of parts for the world’s leaders Aeronautics Industry. Including the production of parts for aircraft engines. Great opportunity for further escalation and receiving the necessary data Price 10k$ Tox: D54B26BFD06593F5C87ED40CF13B1161AA516357F0DF146845FCA3EFD0D6872D9726D4069335 |
| Aeronautics company Canada | · Nov 11, 2022 | Corporate access is on sale. Manufacturing company Partners of this company: UTC Aerospace SystemsBombardier Aerospaceand others Tox: D54B26BFD06593F5C87ED40CF13B1161AA516357F0DF146845FCA3EFD0D6872D9726D4069335 Email:[email protected]@cock.li |
| Aeronautik company Canada | · Nov 11, 2022 | Corporate access is on sale. Partners of this company: UTC Aerospace SystemsBombardier Aerospaceand others Tox: D54B26BFD06593F5C87ED40CF13B1161AA516357F0DF146845FCA3EFD0D6872D9726D4069335 Email:[email protected]@cock.li |
| AT&T | · Oct 28, 2022 | On sale access to the corporate network AT&T USA Tox ID: D54B26BFD06593F5C87ED40CF13B1161AA516357F0DF146845FCA3EFD0D6872D9726D4069335 Email: [email protected];[email protected] |
| Stages Pediatric Care DataBase on Sale | · Oct 27, 2022 | More than 180 GB of data, including medical records and a database containing complete information about clients, payments, laboratory tests 17.8 gb of sql dump (billing,users,demographic,labresults…) Email: [email protected];[email protected] |
| Rundle Eye Care DataBase Leak | · Oct 25, 2022 | 30 gigabytes of data was stolen from this medical companyTax documents, accounting, medical records and personal data of clients, prescription forms. Download: https://gofile.io/d/yPVUpo |
In the newsAll →
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .