Everest

☆ pin

Also known as Everest ransomware gang

Reports

First seen

Nov 1, 2025

Last seen

Oct 17, 2026

Motivation

Financial

Relationships

Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.

Targeting

Sectors

Healthcare ×8 Manufacturing ×7 Technology ×6 Professional Services ×6 Transport & Logistics ×5 Other ×5 Financial Services ×2 Retail & E-commerce ×1

Victim regions

×1

×9

United States×9

Japan×4

Switzerland×3

United Arab Emirates×3

Kuwait×1

France×1

Peru×1

Germany×1

Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.

Top ATT&CK techniques

T1486 Data Encrypted for Impact ×5T1566 Phishing ×3T1190 Exploit Public-Facing Application ×3T1598 Phishing for Information ×2T1005 Data from Local System ×2T1566.002 Phishing: Spearphishing Link ×1T1068 Exploitation for Privilege Escalation ×1T1003 OS Credential Dumping ×1T1547 Boot or Logon Autostart Execution ×1T1078 Valid Accounts ×1T1567 Exfiltration Over Web Service ×1T1059 Command and Scripting Interpreter ×1

Indicators

domain ×65cve ×10

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2021-26829 (exploited)CVE-2024-20353 (exploited)CVE-2024-20359 (exploited)CVE-2025-20333 (exploited)CVE-2025-20362 (exploited)CVE-2025-27915 (exploited)CVE-2025-41244 (exploited)CVE-2025-66376 (exploited)CVE-2026-16232 (exploited)CVE-2026-50522 (exploited)

Recent reports

High

Everest

Relationships

Targeting

Top ATT&CK techniques

Indicators

Associated CVEs

Recent reports

Everest ransomware gang publishes Kissei Shoji as victim

Everest ransomware gang publishes Kissei Shoji as victim

Everest ransomware gang publishes Chugoku Bend as victim

Everest ransomware claims Chugoku Bend as victim

Everest ransomware gang publishes Taekwang Network as victim

Everest ransomware publishes Brenner Base Tunnel as victim

Everest ransomware gang publishes KVH as victim

Everest ransomware publishes Laerdal as victim

Everest ransomware claims Topcon Healthcare victim

Everest ransomware claims Agri Industrial victim

Everest ransomware gang publishes B-accountants as victim

Everest ransomware gang claims Morcon Developments as victim

Everest ransomware gang claims Kennametal as victim

Everest ransomware gang claims Flydubai as new victim

Everest ransomware gang publishes Securitas Group as victim

Everest ransomware publishes Morula IVF as victim

Everest ransomware publishes Reliance Audit as victim

Everest ransomware gang publishes UNIRITA as victim on leak site

Everest ransomware gang publishes CENELEC as victim

Everest ransomware gang publishes new victim: ETS

Everest ransomware group publishes GGS as victim

Everest ransomware gang publishes Körber as victim

Everest ransomware gang publishes GENESILICO as victim

Everest ransomware gang publishes Rise UP as victim

Everest ransomware gang publishes VIVOTEK as victim

Everest ransomware claims Italtel Peru victim

Everest ransomware gang publishes CCA Bank as victim

Everest ransomware gang publishes Kingston Technology as victim

Everest ransomware gang publishes Experts Entreprendre as victim

Everest ransomware gang publishes Grupo DT as victim