Overview
Everest ransom group collects and analyzes information about their victims. They specialize in customer privacy data, financial information, databases, credit card information, and more. The Everest ransom group leaks the victim's data to the darknet and they announced that any victim that will not contact them will suffer from a data leak and they will not delete hist files for future usage.
- First tracked: 2021-09-09
- Discussed in our reports: France · Gulf summary · Kuwait · Qatar · UAE
What public reporting says
- Russian-speaking group active since at least December 2020. Researchers describe a triple model: double-extortion attacks, initial-access brokerage, and a programme that recruits corporate insiders (since late 2023). Technical overlap with BlackByte is reported.
Daily Security Review · BankInfoSecurity
Geography: origin and targets
Assessed origin: Russian Federation. Russian-language group; its encryptor skips systems with CIS locales. Attribution is uncertain: read it as an assessment, not proof.
United States of America116
Italy14
United Arab Emirates12
Germany12
United Kingdom12
Japan10
Spain10
Canada7
India6
Switzerland6
Exploited vulnerabilities
None recorded in the sources we reviewed.
ATT&CK techniques
Columns are ATT&CK tactics; each cell is a technique reported for this group in public sources. A technique appearing here means it has been reported for the group, not that it was used in any particular incident, and an empty cell is not evidence that the group does not use it.
Technique details
Stealth (TA0005)
- T1027 · Obfuscated Files or Information: Binary protected with ConfuserEx: rename obfuscation, constants encryption, integer confusion, and modified module .cctor.
- T1027.007 · Obfuscated Files or Information: Dynamic API Resolution: All non-corlib native API calls resolved at runtime via LoadLibrary / GetProcAddress rather than static imports.
- T1078.003 · Valid Accounts: Local Accounts: Implicit current-user impersonation used for net use \\<unc> connections to discovered network shares without explicit credential passing.
- T1112 · Modify Registry: Multiple HKCU/HKLM registry writes: LongPathsEnabled, LocalAccountTokenFilterPolicy, EnableLinkedConnections (share access), WallPaper (ransom note), AppName\PublicKey (encryption key storage).
- T1140 · Deobfuscate/Decode Files or Information: Runtime decryption of UserStrings via <Module>.m using GZip decompression followed by Base64 decoding.
- T1480 · Execution Guardrails: Global <GUID> mutex enforces single-instance execution; CIS culture/LCID geo-fence prevents execution on CIS-locale systems.
- T1564 · Hide Artifacts: Process self-DACL set to deny-Everyone via KZsyzkgZlDQw.UB, preventing other processes from inspecting or terminating the ransomware process.
- T1622 · Debugger Evasion: Memory-pig killer heuristic: processes consuming more than 250 MB are terminated, targeting sandbox environments and active debuggers.
Discovery (TA0007)
- T1018 · Remote System Discovery: ARP table parsed via arp -a; ARP-driven Wake-On-LAN packets sent to discovered hosts to bring them online before encryption.
- T1135 · Network Share Discovery: Network shares enumerated via net view, NetDfsEnum, WNetEnumResource*, Win32_Share WMI class, and Win32_NetworkConnection.
- T1518.001 · Software Discovery: Security Software Discovery: Anti-analysis kill list matched against ProcessName and MainWindowTitle to identify and terminate security/analysis tools.
- T1614.001 · System Location Discovery: System Language Discovery: CIS culture/LCID check used as exclusion geo-fence; execution aborts if system locale matches CIS-region languages.
Lateral Movement (TA0008)
- T1021.002 · Remote Services: SMB/Windows Admin Shares: net.exe use \\<unc> executed over discovered SMB shares to access and encrypt remote file systems.
Command and Control (TA0011)
- T1071.001 · Application Layer Protocol: Web Protocols: WebClient.DownloadData referenced in Helpers.DownloadUrl — present in code but not reachable at runtime (inert code path).
Impact (TA0040)
- T1486 · Data Encrypted for Impact: AES-128-CBC PKCS#7 / NoPadding (large files) encryption of all eligible files on local drives, mounted unlettered volumes, and LAN shares.
- T1489 · Service Stop: ServiceController.Stop called against ~100 services (AV, backup, MSSQL, Exchange, MBAM, Veeam, Acronis, etc.) combined with sc config <svc> start=disabled to prevent restart.
- T1490 · Inhibit System Recovery: VSS deletion via PowerShell or vssadmin, SRRemoveRestorePoint, backup file deletion (del /s /q), Recycle Bin removal (rd /s /q), Restart Manager used to force-shutdown apps locking target files.
Tools
- ProcDump
- SoftPerfect NetScan
- Cobalt Strike
- Metasploit
- Meterpreter
- AnyDesk
- Atera
- Splashtop
Leak-site infrastructure
| Title | Type | Address (defanged) | Seen online at snapshot |
|---|---|---|---|
| — | Files | aihvh6j6fbkfjyc6jqbsh2ed4s3rym2v2pu6kd3z3exdso2xc2qwcuqd[.]onion | No |
| Everest | DLS | everestndkvzcibcje2cqxhre2hmmybl3rn2gwzwsblz7gx6uryn5rad[.]onion | Yes |
| Everest File Server | Files | 4p2hmbuy36oau64fcvwz2yvdw7eptlkionm46p2m2cs6dmhone5mxiyd[.]onion | Yes |
| — | DLS | ransomocmou6mnbquqz44ewosbkjk3o5qjsl3orawojexfook2j7esad[.]onion | Yes |
| — | Files | bifpwatchoxp7tsb2kpes37b23ogjrb2kj4wgr7yncf4hhgsfahu7jad[.]onion | No |
| — | Files | 2vqamwfdpis5rkjtpkutigykp56n6hkxfurm6qukdxp6uz5uff5kkaid[.]onion | No |
| — | DLS | ransomoefralti2zh5nrv7iqybp3d5b4a2eeecz5yjosp7ggbepj7iyd[.]onion | No |
| — | Files | gxp6yt3wdj7yky27j37jfrrbkuy24n2zo5uxyuoy23uf76d6m2gnfpid[.]onion | No |
Sources and caveats
Group descriptions, ATT&CK mappings, tools and leak-site locations come from public ransomware tracking projects, including ransomware.live and Crocodyli. Exploited vulnerabilities come from the Ransomware-Vulnerability-Matrix by BushidoUK (licensed CC BY 4.0), supplemented where a group profile there is newer than the data we hold. Each CVE links to its original research source. Technical text is shown in English as published. Leak-site addresses are defanged and shown for blocking and detection; do not visit them. Nothing here is verified by ClairSec_ against a specific incident.
Data snapshot: 2026-10-11