THREAT ACTOR
EVEREST_
ActiveEVEREST is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of EVEREST, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2026 167
- 2025 141
- 2024 83
- 2023 37
- 2022 77
- 2021 35
Leak site mirrors
7 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
ransomocmou6mnbquqz44ewosbkjk3o5qjsl3orawojexfook2j7esad.onionPWNED snapshot · 2026-11-08 21:06 -
ransomoefralti2zh5nrv7iqybp3d5b4a2eeecz5yjosp7ggbepj7iyd.onionEverest Group snapshot · 2025-01-20 07:32 -
2vqamwfdpis5rkjtpkutigykp56n6hkxfurm6qukdxp6uz5uff5kkaid.onionIndex of / snapshot · 2025-03-25 08:15 -
bifpwatchoxp7tsb2kpes37b23ogjrb2kj4wgr7yncf4hhgsfahu7jad.onion404 Not Found snapshot · 2025-02-02 17:00 -
aihvh6j6fbkfjyc6jqbsh2ed4s3rym2v2pu6kd3z3exdso2xc2qwcuqd.onionIndex of / snapshot · 2025-03-25 08:09 -
gxp6yt3wdj7yky27j37jfrrbkuy24n2zo5uxyuoy23uf76d6m2gnfpid.onionEverest snapshot · 2025-10-20 13:07 -
everestndkvzcibcje2cqxhre2hmmybl3rn2gwzwsblz7gx6uryn5rad.onionsnapshot · 2026-11-11 01:01
Recent victims
The 50 most recent victims claimed by EVEREST. Total in the index: 540.
| Date listed | Victim | Description |
|---|---|---|
| 2026-10-27 | Energy Storage Terminal in Singapore | 2 posts - 2h |
| 2026-10-27 | TECNA ICE | 2 posts - 2h |
| 2026-10-27 | MediSolution | 2 posts - 1h |
| 2026-10-27 | SleepEx LabRetriever | 2 posts - 1h |
| 2026-10-27 | OR Technology | 2 posts - 1h |
| 2026-10-27 | Burris & MacOmber | 2 posts - 1h |
| 2026-10-27 | Point Robotics | 2 posts - 2h |
| 2026-10-27 | Natuzzi | 2 posts - 2h |
| 2026-10-22 | PWC | 2 posts - 1h |
| 2026-10-22 | Linebarger Goggan Blair & Sampson | 2 posts - 5h |
| 2026-10-21 | PLD Group | 2 posts - 8h |
| 2026-10-21 | Lindauer Dornier | 2 posts - 7h |
| 2026-10-21 | Lanham Associates | 2 posts - 7h |
| 2026-10-21 | Haier | 2 posts - 6h |
| 2026-10-17 | Chugoku Bend | 2 posts - 2h |
| 2026-10-17 | Taekwang Network | 2 posts - 2h |
| 2026-10-17 | Brenner Base Tunnel | 2 posts - 2h |
| 2026-10-16 | Kissei Shoji | 0 posts |
| 2026-10-12 | Topcon Healthcare | 0 posts |
| 2026-10-12 | KVH | 2 posts - 1h |
| 2026-10-12 | Laerdal | 2 posts - 1h |
| 2026-10-06 | Flydubai | 2 posts - 1h |
| 2026-10-06 | Kennametal | 2 posts - 1h |
| 2026-10-06 | Agri Industrial | 2 posts - 2h |
| 2026-10-06 | B-accountants | 2 posts - 1h |
| 2026-10-06 | Morcon Developments | 2 posts - 1h |
| 2026-09-25 | Morula IVF | 2 posts - 1h |
| 2026-09-25 | Securitas Group | 2 posts - 1h |
| 2026-09-25 | Reliance Audit | 2 posts - 1h |
| 2026-09-25 | UNIRITA | 2 posts - 1h |
| 2026-09-25 | CENELEC | 2 posts - 1h |
| 2026-09-25 | ETS | 2 posts - 1h |
| 2026-09-07 | GGS | 2 posts - 1h |
| 2026-09-07 | KÖRBER | 2 posts - 1h |
| 2026-09-07 | GENESILICO | 2 posts - 1h |
| 2026-09-04 | Negotiation Rules | 1 posts - 1h |
| 2026-09-01 | Rise UP | 2 posts - 1h |
| 2026-09-01 | VIVOTEK | 2 posts - 1h |
| 2026-09-01 | Italtel Peru | 2 posts - 1h |
| 2026-08-20 | CCA Bank | 2 posts - 1h |
| 2026-08-20 | Capgemini Engineering | 2 posts - 1h |
| 2026-08-20 | Grupo DT | 2 posts - 1h |
| 2026-08-20 | Kingston Technology | 2 posts - 1h |
| 2026-08-20 | Experts Entreprendre | 2 posts - 1h |
| 2026-08-05 | Keysight | 2 posts - 1h |
| 2026-07-30 | EPM | 2 posts - Jul 6 |
| 2026-07-30 | AKM Enterprises INC | 1 posts - Jun 10 |
| 2026-07-30 | Formulatrix | 2 posts - Jul 6 |
| 2026-07-30 | Oasis Legal Group | 2 posts - Jul 6 |
| 2026-07-30 | Conway Analytics | 3 posts - Jul 7 |
CONFIRMED ATTACKS
Everest confirmed attacks: 55 verified incidents
Ransomnews has verified 55 Everest incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from December 2020 to October 2026. United States accounts for 19 of them (35%), with victims recorded in 17 countries in total. The most affected sector is healthcare, at 12 confirmed victims. A ransom payment was publicly confirmed in 1 case and publicly refused in 5; the outcome is unrecorded in the remaining 49. Where a figure was disclosed (15 cases), these incidents account for 1,350,554 exposed records.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Everest incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| October 2026 | Brenner Base Tunnel SE (BBT SE) | Construction | Italy | — | Unknown | Source |
| October 2026 | Chugoku Bend Co., Ltd. | Manufacturing | Hiroshima, Japan | — | No | Source |
| October 2026 | Kissei Shoji Co., Ltd. | Retail | Japan | — | Unknown | Source |
| September 2026 | Unirita Co., Ltd. | Technology | Tokyo, Japan | — | Unknown | Source |
| July 2026 | Stadler Rail | Manufacturing | Bussnang, Switzerland | — | No | Source |
| May 2026 | Solati SAS | Technology | Bogotá, Colombia | — | Unknown | Source |
| April 2026 | UMILES | Service | Madrid, Spain | — | Unknown | Source |
| February 2026 | Hosokawa Micron Group | Manufacturing | Osaka, Japan | — | Unknown | Source |
| January 2026 | Iron Mountain | Technology | Massachusetts, United States | — | Unknown | Source |
| December 2025 | Accela, Inc. | Technology | California, United States | 56 | Unknown | Source |
| December 2025 | Sefas | Technology | Massachusetts, United States | 199,856 | Unknown | Source |
| December 2025 | Notin.es | Technology | Madrid, Spain | — | Unknown | Source |
| November 2025 | Catalyst RCM | Healthcare | Texas, United States | 139,964 | Unknown | Source |
| November 2025 | Under Armour | Manufacturing | Maryland, United States | — | Unknown | Source |
| November 2025 | Dollar Financial Group, Inc. dba Money Mart | Finance | Pennsylvania, United States | 4,928 | Unknown | Source |
| November 2025 | Agfa-Gevaert N.V. | Manufacturing | Mortsel, Belgium | — | No | Source |
| November 2025 | Iberia | Transportation | Madrid, Spain | — | Unknown | Source |
| November 2025 | SIAD S.p.A. | Manufacturing | Bergamo, Italy | — | Unknown | Source |
| October 2025 | FullBeauty Brands, Inc. | Retail | New York, United States | 4,725 | Unknown | Source |
| October 2025 | Svenska kraftnät | Government | Sundbyberg, Sweden | — | Unknown | Source |
| September 2025 | Dublin Airport | Transportation | Dublin, Ireland | — | Unknown | Source |
| September 2025 | Collins Aerospace | Transportation | North Carolina, United States | — | Unknown | Source |
| September 2025 | Groupe Clarins | Manufacturing | Paris, France | — | Unknown | Source |
| June 2025 | Fishman, Larsen & Callister, P.C. | Legal | California, United States | 3,606 | Unknown | Source |
| June 2025 | PeopleCheck | Service | London, United Kingdom | — | Unknown | Source |
| June 2025 | New American Funding (via Mobile Notary Zone) | Finance | California, United States | — | Unknown | Source |
| May 2025 | Mediclinic Group | Healthcare | Stellenbosch, South Africa | — | Unknown | Source |
| January 2025 | The Hoff Brand, S. L. | Retail | Elche, Spain | — | Unknown | Source |
| December 2024 | Medical Technology Industries, Inc. (MTI) | Healthcare | Utah, United States | — | Unknown | Source |
| November 2024 | Concord Orthopaedics | Healthcare | New Hampshire, United States | 72,815 | Unknown | Source |
| November 2024 | Artistic Family Dental | Healthcare | Illinois, United States | 3,915 | Unknown | Source |
| October 2024 | STIIIZY, Inc. | Retail | California, United States | 380,000 | Unknown | Source |
| October 2024 | Pacific Pulmonary Medical Group | Healthcare | California, United States | 12,723 | Unknown | Source |
| October 2024 | Aspen Healthcare Services | Healthcare | Texas, United States | 8,153 | Unknown | Source |
| August 2024 | Nidec Precision Vietnam Corporation | Manufacturing | Ho Chi Minh City, Vietnam | 50,694 | Unknown | Source |
| June 2024 | Gramercy Surgery Center, Inc. | Healthcare | New York, United States | 50,554 | Unknown | Source |
| December 2023 | Speciality Networks, Inc. | Healthcare | Tennessee, United States | 411,037 | Unknown | Source |
| April 2023 | Instituto Nacional de Tecnología Agropecuaria (INTA) | Government | Buenos Aires, Argentina | — | No | Source |
| October 2022 | Rundle Eye Care | Healthcare | California, United States | 7,528 | Unknown | Source |
| October 2021 | Società Italiana degli Autori ed Editori (SIAE) | Other | Rome, Italy | — | No | Source |
| September 2021 | Steel Projects | Technology | Vienne, France | — | Unknown | Source |
| August 2021 | Tesouro Nacional | Government | Brasilia, Brazil | — | Unknown | Source |
| August 2021 | Alispharm | Healthcare | Lyon, France | — | Unknown | Source |
| June 2021 | Xefi Group | Technology | Rillieux-la-Pape, France | — | Unknown | Source |
| June 2021 | Imprimerie Lamazière | Service | Decines, France | — | Unknown | Source |
| June 2021 | Groupe Confiance Immobilier | Service | Lyon, France | — | Unknown | Source |
| June 2021 | Epsilon Hydraulique | Retail | Craponne, France | — | Unknown | Source |
| June 2021 | Always International | Service | St-Laurent-du-Var, France | — | Unknown | Source |
| June 2021 | Alltech France | Food and Beverage | Vire-Normandie, France | — | Unknown | Source |
| May 2021 | Cabinet Remy Le Bonnois | Legal | Paris, France | — | Yes | Source |
| April 2021 | Centro Hospitalar de Setúbal | Healthcare | Setúbal, Portugal | — | Unknown | Source |
| December 2020 | Traugott Building Contractors, Inc. | Construction | Cambridge, Canada | — | Unknown | Source |
| December 2020 | Stuart Olson, Inc. | Construction | Calgary, Canada | — | Unknown | Source |
| December 2020 | Pomerleau | Construction | Saint-Georges, Canada | — | Unknown | Source |
| December 2020 | Jacob Bros Construction | Construction | Surrey, Canada | — | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Everest's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.