Everest ransomware group

Profile narrative

Everest ransomware group is a threat actor referenced in open‑source reporting under the alias Everest ransomware group. The actor is described as a ransomware operation, which means its activity centers on encrypting data and demanding payment for decryption keys. Publicly attributed incidents show the group has directed activity toward the healthcare sector, specifically targeting a diagnostic company and its affiliated laboratories. The victim organizations involved in the known case handle large volumes of personal, medical and financial information for patients. This focus on entities that manage sensitive health data aligns with the type of data typically sought in ransomware attacks.

In the intrusion that led to the public disclosure, the attackers obtained initial access by exploiting compromised credentials belonging to a third‑party revenue‑cycle management provider. The compromised credentials allowed the threat actor to log into the provider’s secure file management system without triggering multi‑factor authentication alerts. Once inside, the group deployed the Everest ransomware binary to encrypt files on the affected systems. Concurrently with encryption, the actors exfiltrated datasets containing names, dates of birth, payment card details, medical information and health insurance data. After the encryption phase, the group posted the names of the victim company and its subsidiary laboratories on a leak site, a step characteristic of double‑extortion ransomware tactics.

The most detailed public report concerning Everest ransomware group dates to 2025‑11‑01, when the group listed Vikor Scientific, KorPath and Korgene on its leak site. According to the victim’s statement and the provider’s investigation, the breach originated from Catalyst RCM, a revenue‑cycle management firm that supplies billing and coding services to the healthcare company. Catalyst RCM detected anomalous activity in its file management system, traced the activity to the compromised credentials, and confirmed that the accessed files held the aforementioned personal and medical data. The provider estimated that the exposed information related to nearly 140,000 individuals whose records were managed through its services for the diagnostic company and its labs. Catalyst RCM issued breach notifications to the affected individuals, although the exact count of impacted parties has not been separately disclosed by the affiliated laboratories. As of the information supplied, no public source has attributed the Everest ransomware group to a state sponsor, a known criminal consortium, or any specific geographic region.

Incidents

Attributed incidents are available to members.

Sources

Sources available to members: 0 sources.