THREAT ACTOR
EVEREST_
ActiveEVEREST is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of EVEREST, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2026 135
- 2025 141
- 2024 83
- 2023 37
- 2022 77
- 2021 35
Leak site mirrors
7 mirrors tracked, 2 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
ransomocmou6mnbquqz44ewosbkjk3o5qjsl3orawojexfook2j7esad.onionsnapshot · 2026-09-23 05:38 -
ransomoefralti2zh5nrv7iqybp3d5b4a2eeecz5yjosp7ggbepj7iyd.onionEverest Group snapshot · 2025-01-20 07:32 -
2vqamwfdpis5rkjtpkutigykp56n6hkxfurm6qukdxp6uz5uff5kkaid.onionIndex of / snapshot · 2025-03-25 08:15 -
bifpwatchoxp7tsb2kpes37b23ogjrb2kj4wgr7yncf4hhgsfahu7jad.onion404 Not Found snapshot · 2025-02-02 17:00 -
aihvh6j6fbkfjyc6jqbsh2ed4s3rym2v2pu6kd3z3exdso2xc2qwcuqd.onionIndex of / snapshot · 2025-03-25 08:09 -
gxp6yt3wdj7yky27j37jfrrbkuy24n2zo5uxyuoy23uf76d6m2gnfpid.onionEverest snapshot · 2025-10-20 13:07 -
everestndkvzcibcje2cqxhre2hmmybl3rn2gwzwsblz7gx6uryn5rad.onionEverest snapshot · 2026-09-23 05:34
Recent victims
The 50 most recent victims claimed by EVEREST. Total in the index: 508.
| Date listed | Victim | Description |
|---|---|---|
| 2026-09-07 | GGS | 2 posts - 1h |
| 2026-09-07 | KÖRBER | 2 posts - 1h |
| 2026-09-07 | GENESILICO | 2 posts - 1h |
| 2026-09-04 | Negotiation Rules | 1 posts - 1h |
| 2026-09-01 | Rise UP | 2 posts - 1h |
| 2026-09-01 | VIVOTEK | 2 posts - 1h |
| 2026-09-01 | Italtel Peru | 2 posts - 1h |
| 2026-08-20 | CCA Bank | 2 posts - 1h |
| 2026-08-20 | Capgemini Engineering | 2 posts - 1h |
| 2026-08-20 | Grupo DT | 2 posts - 1h |
| 2026-08-20 | Kingston Technology | 2 posts - 1h |
| 2026-08-20 | Experts Entreprendre | 2 posts - 1h |
| 2026-08-05 | Keysight | 2 posts - 1h |
| 2026-07-30 | EPM | 2 posts - Jul 6 |
| 2026-07-30 | AKM Enterprises INC | 1 posts - Jun 10 |
| 2026-07-30 | Formulatrix | 2 posts - Jul 6 |
| 2026-07-30 | Oasis Legal Group | 2 posts - Jul 6 |
| 2026-07-30 | Conway Analytics | 3 posts - Jul 7 |
| 2026-07-30 | Greenbotz | 2 posts - Jul 7 |
| 2026-07-30 | NIMR Oil | 2 posts - Jul 9 |
| 2026-07-30 | TechCorr | 2 posts - Jul 9 |
| 2026-07-30 | Rodschinson Investment | 2 posts - Jul 12 |
| 2026-07-30 | Allied Telesis | 2 posts - Jul 17 |
| 2026-07-30 | Dharma Group | 2 posts - Jul 17 |
| 2026-07-30 | Emirates Flight Catering | 2 posts - Jul 17 |
| 2026-07-30 | Alzone Software | 2 posts - Jul 18 |
| 2026-07-30 | Rx Networks | 2 posts - Jul 21 |
| 2026-07-30 | Al-Futtaim Group | 2 posts - Jul 21 |
| 2026-07-30 | Aptara | 2 posts - Jul 22 |
| 2026-07-30 | Ingersoll Rand | 2 posts - Jul 22 |
| 2026-07-30 | Omnicell | 2 posts - Jul 22 |
| 2026-07-30 | Powerweave | 2 posts - 6d |
| 2026-07-30 | Mansfield Family Dentistry | 2 posts - 6d |
| 2026-07-30 | Stadler Rail | 2 posts - yesterday |
| 2026-05-29 | ЕРМ | |
| 2026-05-29 | Asopagos S.A. | |
| 2026-05-28 | Spedition Kern | |
| 2026-05-28 | Advanced Psychiatry Associates | |
| 2026-05-28 | Sidra Kuwait Hospital | |
| 2026-05-28 | VVO Finance | |
| 2026-05-28 | AKM | |
| 2026-05-28 | L&P Aesthetics | |
| 2026-05-28 | TransferZ | |
| 2026-05-13 | Citizens Bank - Database Leaked | |
| 2026-05-12 | Studio Marchi - Studio Professionale Associato - Database Leaked | |
| 2026-05-12 | Evaluate a Norstella company - Database Leaked | |
| 2026-05-07 | Rehab Clinics Group Ltd | |
| 2026-05-07 | K Subsea Group - Database Leaked | |
| 2026-05-07 | Tokoparts - Database Leaked | |
| 2026-05-07 | Super AI - Database Leaked |
CONFIRMED ATTACKS
Everest confirmed attacks: 51 verified incidents
Ransomnews has verified 51 Everest incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from December 2020 to July 2026. United States accounts for 19 of them (37%), with victims recorded in 17 countries in total. The most affected sector is healthcare, at 12 confirmed victims. A ransom payment was publicly confirmed in 1 case and publicly refused in 4; the outcome is unrecorded in the remaining 46. Where a figure was disclosed (14 cases), these incidents account for 1,350,498 exposed records.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Everest incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| July 2026 | Stadler Rail | Manufacturing | Bussnang, Switzerland | — | No | Source |
| May 2026 | Solati SAS | Technology | Bogotá, Colombia | — | Unknown | Source |
| April 2026 | UMILES | Service | Madrid, Spain | — | Unknown | Source |
| February 2026 | Hosokawa Micron Group | Manufacturing | Osaka, Japan | — | Unknown | Source |
| January 2026 | Iron Mountain | Technology | Massachusetts, United States | — | Unknown | Source |
| December 2025 | Accela, Inc. | Technology | California, United States | — | Unknown | Source |
| December 2025 | Sefas | Technology | Massachusetts, United States | 199,856 | Unknown | Source |
| December 2025 | Notin.es | Technology | Madrid, Spain | — | Unknown | Source |
| November 2025 | Catalyst RCM | Healthcare | Texas, United States | 139,964 | Unknown | Source |
| November 2025 | Under Armour | Manufacturing | Maryland, United States | — | Unknown | Source |
| November 2025 | Dollar Financial Group, Inc. dba Money Mart | Finance | Pennsylvania, United States | 4,928 | Unknown | Source |
| November 2025 | Agfa-Gevaert N.V. | Manufacturing | Mortsel, Belgium | — | No | Source |
| November 2025 | Iberia | Transportation | Madrid, Spain | — | Unknown | Source |
| November 2025 | SIAD S.p.A. | Manufacturing | Bergamo, Italy | — | Unknown | Source |
| October 2025 | FullBeauty Brands, Inc. | Retail | New York, United States | 4,725 | Unknown | Source |
| October 2025 | Svenska kraftnät | Government | Sundbyberg, Sweden | — | Unknown | Source |
| September 2025 | Dublin Airport | Transportation | Dublin, Ireland | — | Unknown | Source |
| September 2025 | Collins Aerospace | Transportation | North Carolina, United States | — | Unknown | Source |
| September 2025 | Groupe Clarins | Manufacturing | Paris, France | — | Unknown | Source |
| June 2025 | Fishman, Larsen & Callister, P.C. | Legal | California, United States | 3,606 | Unknown | Source |
| June 2025 | PeopleCheck | Service | London, United Kingdom | — | Unknown | Source |
| June 2025 | New American Funding (via Mobile Notary Zone) | Finance | California, United States | — | Unknown | Source |
| May 2025 | Mediclinic Group | Healthcare | Stellenbosch, South Africa | — | Unknown | Source |
| January 2025 | The Hoff Brand, S. L. | Retail | Elche, Spain | — | Unknown | Source |
| December 2024 | Medical Technology Industries, Inc. (MTI) | Healthcare | Utah, United States | — | Unknown | Source |
| November 2024 | Concord Orthopaedics | Healthcare | New Hampshire, United States | 72,815 | Unknown | Source |
| November 2024 | Artistic Family Dental | Healthcare | Illinois, United States | 3,915 | Unknown | Source |
| October 2024 | STIIIZY, Inc. | Retail | California, United States | 380,000 | Unknown | Source |
| October 2024 | Pacific Pulmonary Medical Group | Healthcare | California, United States | 12,723 | Unknown | Source |
| October 2024 | Aspen Healthcare Services | Healthcare | Texas, United States | 8,153 | Unknown | Source |
| August 2024 | Nidec Precision Vietnam Corporation | Manufacturing | Ho Chi Minh City, Vietnam | 50,694 | Unknown | Source |
| June 2024 | Gramercy Surgery Center, Inc. | Healthcare | New York, United States | 50,554 | Unknown | Source |
| December 2023 | Speciality Networks, Inc. | Healthcare | Tennessee, United States | 411,037 | Unknown | Source |
| April 2023 | Instituto Nacional de Tecnología Agropecuaria (INTA) | Government | Buenos Aires, Argentina | — | No | Source |
| October 2022 | Rundle Eye Care | Healthcare | California, United States | 7,528 | Unknown | Source |
| October 2021 | Società Italiana degli Autori ed Editori (SIAE) | Other | Rome, Italy | — | No | Source |
| September 2021 | Steel Projects | Technology | Vienne, France | — | Unknown | Source |
| August 2021 | Tesouro Nacional | Government | Brasilia, Brazil | — | Unknown | Source |
| August 2021 | Alispharm | Healthcare | Lyon, France | — | Unknown | Source |
| June 2021 | Xefi Group | Technology | Rillieux-la-Pape, France | — | Unknown | Source |
| June 2021 | Imprimerie Lamazière | Service | Decines, France | — | Unknown | Source |
| June 2021 | Groupe Confiance Immobilier | Service | Lyon, France | — | Unknown | Source |
| June 2021 | Epsilon Hydraulique | Retail | Craponne, France | — | Unknown | Source |
| June 2021 | Always International | Service | St-Laurent-du-Var, France | — | Unknown | Source |
| June 2021 | Alltech France | Food and Beverage | Vire-Normandie, France | — | Unknown | Source |
| May 2021 | Cabinet Remy Le Bonnois | Legal | Paris, France | — | Yes | Source |
| April 2021 | Centro Hospitalar de Setúbal | Healthcare | Setúbal, Portugal | — | Unknown | Source |
| December 2020 | Traugott Building Contractors, Inc. | Construction | Cambridge, Canada | — | Unknown | Source |
| December 2020 | Stuart Olson, Inc. | Construction | Calgary, Canada | — | Unknown | Source |
| December 2020 | Pomerleau | Construction | Saint-Georges, Canada | — | Unknown | Source |
| December 2020 | Jacob Bros Construction | Construction | Surrey, Canada | — | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Everest's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.