Everest

Everest is a Russia-linked ransomware operation active since at least 2020 and commonly described as a ransomware-as-a-service group. It has conducted double-extortion campaigns in which victims’ data is stolen and systems may be encrypted, followed by threats to publish the data if payment is refused. Over time, Everest has increasingly shifted from traditional network encryption toward data-theft-focused extortion, and it has also been associated with initial access brokering and resale of compromised network access to other threat actors. Reporting also indicates the group has at times used data obtained by other actors in its own extortion activity and has attempted to recruit corporate insiders.

Everest has targeted organizations across multiple sectors, including government, healthcare, telecommunications, transportation, finance, manufacturing, aviation, and technology, with victims reported in North America, Europe, and Asia. Publicly claimed incidents and reporting tie the group to compromises involving third-party suppliers and shared platforms as well as direct enterprise intrusions. Observed access methods associated with Everest include exploitation of vulnerable public-facing applications, phishing, and use of stolen or compromised credentials.

Technical analysis of the Everest encryptor shows a Windows-focused .NET ransomware payload protected with ConfuserEx. The malware performs file encryption while emphasizing defense evasion and operational disruption. Documented behaviors include mutex-based single-instance control, geofencing to avoid systems configured for CIS-language locales, termination of security and analysis tools, disabling Windows Defender Controlled Folder Access, deletion of shadow copies, removal of backup-related data, and self-deletion after execution. The encryptor has also been observed using Wake-on-LAN to wake sleeping devices so they can be encrypted. Analysis of one live sample found no built-in data exfiltration capability, indicating that theft in Everest incidents may occur earlier in the intrusion through separate tooling rather than through the ransomware binary itself.

Everest remains notable for blending ransomware, pure extortion, and access-broker activity, making it relevant both as a malware family and as a broader criminal operation.