Everest
Everest is a ransomware group active since at least December 2020, known for its double-extortion tactics. The group initially operated as a typical ransomware outfit, encrypting files with strong cryptography and appending victim-specific extensions, but later shifted toward pure data extortion—threatening to sell or release stolen data without necessarily deploying encryption. Everest targets a wide range of sectors, including government, healthcare, manufacturing, and IT services, with confirmed victims in North America, Europe, and Asia. Initial access vectors include exploitation of vulnerable public-facing applications, phishing campaigns, and credential theft for remote access services. The group maintains a Tor-based leak site to publish stolen information and advertise access to compromised networks.
Most affected countries
- United States5
- France2
- United Arab Emirates2
- Japan2
- Germany1
- Taiwan1
- Belgium1
- Peru1
Most affected sectors
- Technology12
- Other8
- Professional services6
- Manufacturing3
- Telecommunications2
- Finance & insurance2
- Healthcare2
- Energy & utilities2
Recent victims
| Organisation | Country | Sector | Claimed | Status |
|---|---|---|---|---|
| Morula IVF | — | Healthcare | 9/25/2026 | ◌ Claimed (unverified) |
| Securitas Group | — | Professional services | 9/25/2026 | ◌ Claimed (unverified) |
| 🔒 Empresa de servicios profesionales | — | Professional services | 9/25/2026 | ◌ Claimed (unverified) |
| UNIRITA | Japan | Technology | 9/25/2026 | ◌ Claimed (unverified) |
| CENELEC | Belgium | Professional services | 9/25/2026 | ◌ Claimed (unverified) |
| 🔒 Organización o entidad | — | Other | 9/25/2026 | ◌ Claimed (unverified) |
| 🔒 Entidad de sector no determinado | — | Other | 9/7/2026 | ◌ Claimed (unverified) |
| Körber | Germany | Manufacturing | 9/7/2026 | ◌ Claimed (unverified) |
| 🔒 Entidad sin información suficiente | — | Other | 9/7/2026 | ◌ Claimed (unverified) |
| 🔒 Entidad no identificada | — | Other | 9/4/2026 | ◌ Claimed (unverified) |
| 🔒 Entidad o iniciativa desconocida | — | Other | 9/1/2026 | ◌ Claimed (unverified) |
| VIVOTEK | Taiwan | Technology | 9/1/2026 | ◌ Claimed (unverified) |
| Italtel Peru | Peru | Telecommunications | 9/1/2026 | ◌ Claimed (unverified) |
| CCA Bank | — | Finance & insurance | 8/20/2026 | ◌ Claimed (unverified) |
| Capgemini Engineering | France | Professional services | 8/20/2026 | ◌ Claimed (unverified) |
| Grupo DT | — | Other | 8/20/2026 | ◌ Claimed (unverified) |
| Kingston Technology | United States | Technology | 8/20/2026 | ◌ Claimed (unverified) |
| Experts Entreprendre | France | Professional services | 8/20/2026 | ◌ Claimed (unverified) |
| Keysight | United States | Technology | 8/4/2026 | ◌ Claimed (unverified) |
| EPM | Colombia | Energy & utilities | 7/30/2026 | ◌ Claimed (unverified) |
| AKM Enterprises INC | — | Other | 7/30/2026 | ◌ Claimed (unverified) |
| Formulatrix | — | Technology | 7/30/2026 | ◌ Claimed (unverified) |
| Oasis Legal Group | — | Legal | 7/30/2026 | ◌ Claimed (unverified) |
| Conway Analytics | — | Professional services | 7/30/2026 | ◌ Claimed (unverified) |
| Greenbotz | — | Technology | 7/30/2026 | ◌ Claimed (unverified) |
Claims are published by the criminal groups themselves and are unverified until the organisation or the press confirms them. Names of natural persons (sole traders, individual professionals) are anonymised under the GDPR. We never link to leak sites or stolen data. To request the removal or anonymisation of an entry, contact the site administrator.
Sources: RansomLook (CC BY 4.0), MITRE ATT&CK®, MISP Galaxy, Google News.