Ransomware group profile · #18 by claimed victims

Everest ransomware

Everest ransom group collects and analyzes information about their victims. They specialize in customer privacy data, financial information, databases, credit card information, and more. The Everest ransom group leaks the victim's data to the darknet and they announced that any victim that will not contact them will suffer from a data leak and they will not delete hist files for future usage.

Active First seen Sep 2021

399Victims claimed on leak sites

12Victims in the last 30 days

34Victims in the last 90 days

36Countries hit

7Leak-site URLs tracked, 1 online

7 Sep 2026Latest claim recorded

Victimology

Who Everest claims to have breached, from 399 leak-site posts recorded by VULONE.

Claims per month last 12 months

Top sectors

Healthcare65

Technology63

Professional Services63

Manufacturing55

Financial Services39

Retail & E-Commerce24

Energy & Utilities20

Government & Defense20

Top countries

United States115

Italy14

United Kingdom12

Germany12

United Arab Emirates11

Spain10

Japan9

Canada7

Latest claimed victims 12 most recent

Victim	Sector	Country	Claimed
GGS	Not Found	—	7 Sep 2026
KÖRBER	Manufacturing	DE	7 Sep 2026
GENESILICO	Technology	IT	7 Sep 2026
Negotiation Rules	Professional Services	—	4 Sep 2026
Rise UP riseup.ai	Technology	—	1 Sep 2026
VIVOTEK vivotek.com	Technology	TW	1 Sep 2026
Italtel Peru	Technology	PE	1 Sep 2026
CCA Bank cca-bank.com	Financial Services	—	20 Aug 2026
Kingston Technology kingston.com	Technology	US	20 Aug 2026
Experts Entreprendre expert-entreprendre.com	Professional Services	FR	20 Aug 2026
Grupo DT grupodt.es	Other	ES	20 Aug 2026
Capgemini Engineering capgemini.com	Professional Services	FR	20 Aug 2026

All 399 Everest victims, searchable

Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.

Start free Sign in

Tactics, techniques and procedures

ATT&CK technique mapping for Everest is in progress. Victimology, infrastructure status and leak-site tracking are live above.

Indicators, detections and the full playbook

Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.

See full IOCs

Frequently asked

Is Everest ransomware still active?

Everest is tracked as active. The most recent leak-site claim VULONE recorded is dated 7 September 2026. 12 victims were claimed in the last 30 days.

How many victims has Everest claimed?

VULONE has recorded 399 leak-site victim claims attributed to Everest since September 2021, across 36 countries and 14 sectors.

Which industries does Everest target?

The sectors most often named on the Everest leak site are Healthcare, Technology, Professional Services.

Which countries are most affected by Everest?

Most Everest victims recorded by VULONE are located in United States, Italy, United Kingdom.

Where does VULONE get Everest victim data?

Claims are collected continuously from the group's own leak sites and cross-checked with ransomware.live and RansomLook. A claim is the group's assertion, not a confirmed breach.

Other ransomware groups

Victim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 16 September 2026. Questions or corrections: [email protected].