everest
ransomware group · aka Everest, EVEREST, Everest ransomware group · unknown · active since late 2024, per public ransomware trackers and vendor research (Cyberint/Check Point described it as newly emerged in early-2025 reporting); exact first-seen date unknown
Victims · 7d
0▼4
Victims · 30d
12active targets
Victims · 90d
34
All-time (tracked)
503since 2021-09-09
Last post
09-07 17:26UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
Everest is a ransomware and data-extortion group that emerged in late 2024 and operates as a ransomware-as-a-service (RaaS) brand, reportedly recruiting affiliates on underground forums including RAMP, per Cyberint/Check Point research (2025). It uses double extortion - stealing data and encrypting systems - and is notable for publicly marketing a 'no-leak' pledge, claiming it deletes stolen data and provides proof of deletion after payment rather than reselling or publishing it (vendor reporting, 2025). The group runs a Tor leak site where it names victims; attribution and national origin remain unknown, and no law-enforcement action against it has been publicly announced. Dashboard tracking shows low-volume, intermittent leak-site activity: 4 posts total since 2026-09-04, most recently 2026-09-07. Everest was cited in 2025-26 regional threat coverage discussing Qatar's threat landscape, and it should not be confused with a distinct older Everest-named file-encrypting strain documented around 2020.
Tactics & tooling
- Double extortion: exfiltrates victim data and deploys encryption, threatening publication on its Tor leak site
- RaaS model: advertises for affiliates on underground forums, including RAMP, per Cyberint/Check Point research (2025); affiliate infrastructure attribution largely unknown
- 'No-leak' payment pledge: publicly claims stolen data will be deleted, with proof of deletion provided after ransom payment, rather than leaked or resold (per Cyberint/Check Point, 2025)
- Victim shaming via leak-site posts naming targeted organizations; observed posting cadence is low-volume and intermittent (dashboard tracking, 2026)
- Initial-access tradecraft not comprehensively documented in public reporting; no specific CVE exploitation or access-broker purchases publicly confirmed - unknown as of the dashboard period
Targeted sectors
manufacturing/engineeringtechnologylife sciences/biotech
Notable public victims
Koerber (KUERBER) - German international technology/engineering group, publicly listed on Everest's leak site per dashboard tracking (September 2026), GGS - publicly named on Everest's leak site per dashboard tracking; sector and details unknown, GeneSilico - publicly named on Everest's leak site per dashboard tracking; life-sciences/biotech; details unknown, Negotiation Rules - listed by this dashboard among recent posts; likely the group's posted negotiation-rules entry rather than a victim organization, a common leak-site practice - unconfirmed
Estimated earnings
No public figure.
Leak-site victims503 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| Stages Pediatric Care New 250 personal records | · Oct 21, 2022 | https://gofile.io/d/yCowHN Romero,Aaliyah Address Line 1 1300 Fountainhead Dr City Deltona State FL Zip 32725 Phone 386-328-2585 DateOfBirth 07/02/2009 SSN 766-84-4939Slone,Kameryn L Address Line 1 235 Rosedale dr City Deltona State FL Zip 32738 Phone 407-417-1094 DateOfBirth 04/04/2008 SSN 772-70-1757Williams,Trenten B Address Line 1 357 W Central Ave City Orange City State FL Zip 32763 Phone […] |
| Stages Pediatric Care New 40 personal records | · Oct 21, 2022 | if there is no payment from the company, more than 200 personal records will be posted tomorrow evening |
| MultiCareInc pt.3 | · Oct 18, 2022 | Another piece of information, keep thinking that we have nothing important3 Archives with password ,which we reveal if company will not pay ransom before SaturdayFor Kari – don’t behave like this in such cases.https://dropmefiles.com/LvRR8https://gofile.io/d/9H4s3Dhttps://gofile.io/d/DiIDVwhttps://gofile.io/d/UKrYdW |
| MultiCareInc DataBase Leak | · Oct 18, 2022 | https://dropmefiles.com/LvRR8https://gofile.io/d/9H4s3Dhttps://gofile.io/d/DiIDVwhttps://gofile.io/d/UKrYdW Password: Everestgroup12343291 120+ GB of company medical data stolen and most files was encryptedover 37,000 different medical documents including 23195 Medical recordsAlso 4437 medical records of Devero clientsDifferent internal documents,certs and contracts with institutions and individuals for serviceAmong the list of clients there are also well-known personalities in the region or their direct relatives |
| Stages Pediatric Care new personal data | · Oct 18, 2022 | Monday we didn’t get what we promisedanother piece of personal dataUntil we receive payment, the data will appear on the blogAt the end of the week, all 190 gigabytes will be published in free access David Tamayo A 935 Mckenny Ave Deltona FL 32725 386-575-2884 407-461-9280 05/28/2003 772-20-5822 MaleDrexel Petrone A 35 Bobcat Ln Osteen […] |
| MultiCare DataBase Leak | · Oct 15, 2022 | https://dropmefiles.com/LvRR8https://gofile.io/d/9H4s3Dhttps://gofile.io/d/DiIDVwhttps://gofile.io/d/UKrYdW Password: Everestgroup12343291 120+ GB of company medical data stolen and most files was encryptedover 37,000 different medical documents including 23195 Medical recordsAlso 4437 medical records of Devero clientsDifferent internal documents,certs and contracts with institutions and individuals for serviceAmong the list of clients there are also well-known personalities in the region or their direct relatives |
| Electricity company / Air Defense Solutions company | · Oct 15, 2022 | Access to all servers. Domain administrator,active directory includes. After the purchase, you will receive Full control over the Energy Company of South Africa in your own hands. Root access to many servers. Administration servers, Databases, backups, employee access to the administration of POS terminals and much more. Multiple settings and developments. You can become the […] |
| Electricity company pt.3 | · Oct 13, 2022 | South Africa State-owned company for generating, transmitting and distributing electricity. With this data, you can easily turn off the electricity of an entire country. Access to all servers. Domain administrator,active directory includes.Root access to many servers. Administration servers, Databases, backups, employee access to the administration of POS terminals and much more. Multiple settings and developments. […] |
| MultiCare pt.3 | · Oct 12, 2022 | Another piece of information, keep thinking that we have nothing important3 Archives with password ,which we reveal if company will not pay ransom before SaturdayFor Kari – don’t behave like this in such cases.https://dropmefiles.com/LvRR8https://gofile.io/d/9H4s3Dhttps://gofile.io/d/DiIDVwhttps://gofile.io/d/UKrYdW |
| Stages Pediatric Care Update | · Oct 12, 2022 | We have already told you about the timing, while you are thinking, we will continue to post information, the next step will be to publish data and notify customersWe are waiting for the agreed payment from the company or recovery within 24 hours |
| Electricity company pt.2 | · Oct 10, 2022 | After the purchase, you will receive Full control over the Energy Company of South Africa in your own hands. Sale is still relevant South Africa State-owned company for generating, transmitting and distributing electricity.Access to all servers. Domain administrator,active directory includes.Root access to many servers. Administration servers, Databases, backups, employee access to the administration of POS […] |
| RS.GOV.BR/Government Brazil | · Oct 10, 2022 | For sale access to the gov.br network. https://www.rs.gov.br/ network including.Access to 3 networks, all linked to a gov.br domain .The package is not sold separately as all accesses are interconnected.There is more than 3 TB of data associated with the sector on the main access. A huge amount of CPF, RG, Passport,tax documents and other […] |
| Electricity company | · Oct 8, 2022 | State-owned company for generating, transmitting and distributing electricity.Access to all servers, DA includes.Root access to many servers. Administration servers, Databases, backups, employee access to the administration of POS terminals and much more. Multiple settings and developments. You can become the king of electricity the whole country. Trust access of a well-known defense company from USA, […] |
| SPERONI S.P.A / Data Lamborghini, Ferrari, Fiat Group, VAG, Brembo | · Oct 7, 2022 | 38 GB available to downloading as DEMOAll info sell as is and as one package and in one hand!Contact us:[email protected]@cock.li Lamborghini:https://dropmefiles.com.ua/ua/KscUAndrea Speroni CEO / [email protected] pst part1:12GBhttps://dropmefiles.com.ua/ua/[email protected] pst part2:20GBhttps://dropmefiles.com.ua/ua/MNfBsX2eY4Purchasing:6GBhttps://dropmefiles.com.ua/ua/KAwXy World famous company from Italy. Engaged in the production of machine tools and the development of software for them. Included in the top 4 such companies […] |
| MultiCare pt.2 | · Oct 6, 2022 | The company stopped contacting us, believing that their customer data is not something to worry about.As promised new dataClients and their relatives will certainly be happy with this fact |
| Rundle Eye Care | · Oct 6, 2022 | 30 gigabytes of data was stolen from this medical companyTax documents, accounting, medical records and personal data of clients, prescription formsThe owners of the company were notified of the incident in person and of the time frame.The company should contact us soon, otherwise more data will be released. |
| MultiCare Home Health | · Oct 2, 2022 | 120+ GB of company medical data stolen and most files was encryptedover 37,000 different medical documents including 23195 Medical records Also 4437 medical records of Devero clients Different internal documents,certs and contracts with institutions and individuals for serviceAmong the list of clients there are also well-known personalities in the region or their direct relatives (for […] |
| Stages Pediatric Care | · Sep 30, 2022 | More than 180 GB of data was stolen, including medical records and a database containing complete information about clients, payments, laboratory tests, and so on.company management should reply to us within the next 2 days. Otherwise, we will publish patient data every day Patient Name : Montell,Isabella D Address Line 1: 2609 Sedgefield Ave Address […] |
| FederalBank/Fedfina DataBase Leak | · Sep 26, 2022 | Whole personal Info DB available for download. Published 637,895 records of customer personal data https://gofile.io/d/7RvzH5https://dropmefiles.com.ua/ua/LUmB8XwHhttps://dropmefiles.com.ua/ua/hEX2esARNhttps://dropmefiles.com.ua/ua/fVUDhttps://gofile.io/d/pwXZW1https://gofile.io/d/PyxgVzhttps://gofile.io/d/JvT4EQhttps://dropmefiles.com/xnXeMhttps://dropmefiles.com/6X4BFhttps://dropmefiles.com/ss0vn |
| Ministerio de Economía Argentina | · Sep 22, 2022 | For sale network access to the Ministerio de Economía Argentina. Access also to various financial instruments and software of the ministry For questions, contact: [email protected] or [email protected] |
| Government Brazil | · Sep 19, 2022 | For sale access to the gov.br network. Access to 3 networks, all linked to a gov.br domain .The package is not sold separately as all accesses are interconnected.There is more than 3 TB of data associated with the sector on the main access. A huge amount of CPF, RG, Passport,tax documents and other personal data. […] |
| FederalBank/Fedfina.part5 | · Sep 15, 2022 | After sorting the Fedfina’s databases and filesWe post 1000 records for free access.https://gofile.io/d/cn4v4TIf an adequate dialogue with the representatives of the company does not take place in the coming days637,895 records of customer personal data will be published |
| GOV Brazil | · Aug 30, 2022 | — |
| Olamgroup | · Aug 24, 2022 | — |
| FederalBank/Fedfina.part4 | · Jul 26, 2022 | FEDFINA should reconsider their views on the situation ASAP , in addition to internal documents, internal correspondence will also be published24 Archive Email boxes+609 eml files+18040 different .msg filesAll files attached to letters are also savedA lot of interesting information will be available to the public.P.s Security alerts for anything but not what was neededP.s.s […] |
| FederalBank/Fedfina.part3 | · Jul 22, 2022 | These wonderful people continue to remain silent and hide the fact of data leakage from their company, without giving any comments.That what happens when you follow policy If i ignore problem – it will disappear, as well as in relation to the thousands and thousands personal data of their customers,we still hide customer sensitive data […] |
| FederalBank/Fedfina.part2 | · Jul 20, 2022 | FEDFINA CEO Anil KothuriFedbank and Fedfina connections in documentsFurther – more interestingWe will happily and quickly unlock your systems and delete all stolen dataP.s Never trust to 24×7 system monitoring by SIFY. No alerts for 6 months of network researching 😛 Otherwise, 1130 GB of internal data will be published and decryption key will be […] |
| FederalBank / Fedfina | · Jul 18, 2022 | The company has 48 hours to contact usOtherwise, 1130 GB of internal data will be published and decryption key will be deletedData includesFinancial documents(loans,budgets,….)Internal correspondenceKYC dataPersonal data and documents of employeesClients personal data and documents including balances and debtsPersonal data and documents of management and directorsFile tree below: https://dropmefiles.com/pZ5vU Company: Federal Bank LimitedFedbank Financial Services […] |
| Pontal Engineering Constructions and Developments Files Leak | · Jul 11, 2022 | More than 140 GB of data was downloaded from the company’s servers.-Personal data of employees and clients-Passports-Contracts-Tenders-Financial documents-Internal correspondence and emailsThe company’s management was notified of the incident and possible consequences. Files:https://dropmefiles.com.ua/en/sDHw6BLQCShttps://dropmefiles.com.ua/en/USVAcZm8https://dropmefiles.com.ua/en/6s2zXKAMPass: 12345 The company decided to turn a blind eye to the leakage of data of its company and its employees. We fulfill our […] |
| Pontal Engineering Constructions and Developments | · Jul 5, 2022 | — |
| Amalfitana Gas Srl | · Jul 2, 2022 | The company must contact us by the end of next Monday to contact us to decrypt files and delete internal company documents Internal correspondence Contracts for the construction of a gas pipeline to the regions Lists of clients served, invoices and tax documents Complaints and insurance incidents As well as other documents that were downloaded […] |
| Metek PLC Files Leak | · Jun 14, 2022 | — |
| Metek Plc | · Jun 11, 2022 | — |
| VTVCAB | · Jun 6, 2022 | — |
| Lamborghini, Ferrari, Fiat Group, VAG, Brembo And data from other automobile concerns | · May 26, 2022 | — |
| Limited May Access Sale | · May 2, 2022 | — |
| Collegiate sports medicine | · May 1, 2022 | — |
| Reckitt Benckiser | · Apr 21, 2022 | — |
| Standard Building Supplies Ltd. | · Apr 17, 2022 | — |
| Standard Building Supplies Ltd | · Apr 14, 2022 | — |
| Supplies Company Data Leak in British Columbia, Canada | · Apr 13, 2022 | — |
| United States of America GOV | · Apr 7, 2022 | — |
| Ministry of Economy and Finance of Peru | · Mar 24, 2022 | — |
| South Africa Electricity company | · Mar 17, 2022 | — |
| Instituto Nacional de Tecnología Agropecuaria | · Mar 15, 2022 | — |
| News | · Mar 14, 2022 | New email : [email protected] |
| UK GOV | · Mar 14, 2022 | — |
| XEFI / Neocyber | · Mar 12, 2022 | — |
| XEFI | · Mar 8, 2022 | — |
| Turner Construction Company | · Mar 7, 2022 | — |
In the newsAll →
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .