Signalis
sign in--:--:--UTC
Threat actors

Everest

Reports
11
First seen
Nov 1
Last seen
May 29
Motivation
extortion, financial

Targeting

Sectors
healthcare ×3other ×1financial services ×1transportation logistics ×1
Victim regions
Kuwait ×1United States ×1

Top ATT&CK techniques

T1005 Data from Local System ×2T1190 Exploit Public-Facing Application ×2T1486 Data Encrypted for Impact ×2T1566 Phishing ×2T1566.002 Phishing: Spearphishing Link ×1T1498 Network Denial of Service ×1T1070.001 Indicator Removal: Clear Windows Event Logs ×1T1598 Phishing for Information ×1T1561 Disk Wipe ×1T1489 Service Stop ×1T1547 Boot or Logon Autostart Execution ×1T1041 Exfiltration Over C2 Channel ×1

Indicators

domain ×12cve ×7

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2021-26829 (exploited)CVE-2024-20353 (exploited)CVE-2024-20359 (exploited)CVE-2025-20333 (exploited)CVE-2025-20362 (exploited)CVE-2025-27915 (exploited)CVE-2025-41244 (exploited)

Recent reports

High

Everest ransomware gang publishes Asopagos S.A. as new victim

ransomware.liveHigh

Everest ransomware gang publishes ЕРМ as new victim

ransomware.liveHigh

Everest ransomware claims Spedition Kern victim

ransomware.liveHigh

Everest ransomware claims Advanced Psychiatry Associates as victim

ransomware.liveHigh

Everest ransomware claims Sidra Kuwait Hospital victim

ransomware.liveHigh

Everest ransomware claims victim: VVO Finance

ransomware.liveHigh

Everest ransomware publishes AKM as victim

ransomware.liveHigh

Everest ransomware claims TransferZ as victim

ransomware.liveHigh

Everest ransomware claims L&P Aesthetics victim

ransomware.liveHigh

Cyber Brief November 2025: Operation Endgame, Sandworm Wipers, China AI Espionage

CERT-EU Threat IntelHigh

Cyber Brief October 2025 – Espionage, Disruption, Data Breaches, and Supply Chain Threats

CERT-EU Threat Intel

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.

Sign upSee plans