Everest
Attribution profile
- Type
- Crime Syndicate
- Location
- Brazil
- Known incidents
- 17 incidents
- Sources
- 6 sources
- First seen
- 2021-10-20
- Last seen
- 2026-07-01
- Updated
- 2026-10-13 04:25
- Aliases
- 2 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
Everest, also known as Everest Group, is a ransomware threat actor believed to be connected to Black‑Byte ransomware operations and identified as a Russian‑speaking group with a known presence in Brazil. The actor primarily seeks financial gain through double extortion tactics, stealing sensitive data before encryption and threatening to publish it unless a ransom is paid, while also selling access to compromised networks on leak sites. Everest has demonstrated a broad targeting pattern across sectors including transportation (Stadler Rail), banking (Citizens Bank, Frost Bank), healthcare (Vikor Scientific/Vanta Diagnostics and affiliated laboratories via Catalyst RCM), telecommunications (AT&T), government (Brazilian government, ESKOM), and intellectual property (SIAE). Initial access is frequently obtained through compromised credentials, phishing emails delivering remote access tools, or exploitation of third‑party vendor relationships, with lateral movement often facilitated by RDP. Notable operations include the 2026‑07‑01 Stadler Rail attack demanding ten million Swiss francs, the 2026‑04‑20 breaches of Citizens Bank and Frost Bank affecting millions of records, the 2026‑04‑01 alleged Adobe breach via an Indian BPO contractor, the 2025‑11‑01 healthcare diagnostic firm incident through Catalyst RCM exposing over 140 000 individuals, the 2025‑11‑01 Under Armour breach involving approximately 72 million email addresses, the 2022‑10‑28 claim against AT&T, the 2022‑10‑08 ransom demand on ESKOM, the 2022‑09‑19 claim of stealing 3 TB of Brazilian government data, and the 2021‑10‑22 SIAE attack exposing Italian celebrities’ personal data. These activities illustrate the group’s reliance on credential‑based intrusion, vendor‑supply chain compromise, and double extortion for monetary profit.
Incidents
Attributed incidents are available to members.
17 incidentsSources
Sources available to members: 6 sources.