Everest

Profile narrative

Everest ransomware group is a threat actor that has been observed operating under the alias Everest ransomware group. The group came to public attention in November 2025 when it claimed responsibility for a ransomware attack against a major sportswear and fitness brand. In that incident the actors asserted they had encrypted the victim’s networks and threatened to release internal files unless a ransom was paid, thereby attempting to extort the organization. The breach resulted in the exposure of approximately seventy‑two million customer records, which were later posted on a hacker forum and circulated widely. The leaked data included names, email addresses, dates of birth, genders, approximate locations derived from postal codes, purchase histories, and employee email addresses, although the company reported no evidence that payment‑processing systems or password stores were compromised.

The group’s observed tactics involve deploying the Everest ransomware malware to encrypt victim systems while simultaneously exfiltrating sensitive information for double‑extortion purposes. After encryption, the actors published the stolen data on a public hacking forum to increase pressure on the target, a technique that aligns with their stated goal of financial gain through extortion. No specific initial‑access vectors, tooling beyond the ransomware payload, or additional malware families were disclosed in the publicly available reporting. The attack appears to have been conducted with the intent to monetize the compromised data rather than to pursue espionage or disruptive objectives.

This single publicly documented operation illustrates the group’s focus on financially motivated ransomware campaigns that combine data encryption with threatened leakage. While the sportswear and fitness sector was the target in this case, no broader pattern of sectoral or geographic targeting has been established in open sources. The Everest ransomware group remains notable for its use of the eponymous ransomware variant and its reliance on extortion tactics to derive profit from victim organizations.

Incidents

Attributed incidents are available to members.

Sources

Sources available to members: 0 sources.