// THREAT ACTOR

EVEREST_

Active

EVEREST is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem — file encryption combined with the threat of stolen-data publication on a public leak site — and continues to post fresh victim claims as part of an ongoing extortion campaign.

For Ransomnews editorial coverage of EVEREST — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.

496 Victims tracked

2 / 7 Active mirrors

2021-09-09 First listing

2026-08-05 Most recent

Victims by year

2026 123
2025 141
2024 83
2023 37
2022 77
2021 35

Leak site mirrors

7 mirrors tracked, 2 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.

ransomocmou6mnbquqz44ewosbkjk3o5qjsl3orawojexfook2j7esad.onion Everest Group Has Moved snapshot · 2026-08-06 21:12
ransomoefralti2zh5nrv7iqybp3d5b4a2eeecz5yjosp7ggbepj7iyd.onion Everest Group snapshot · 2025-01-20 07:32
2vqamwfdpis5rkjtpkutigykp56n6hkxfurm6qukdxp6uz5uff5kkaid.onion Index of / snapshot · 2025-03-25 08:15
bifpwatchoxp7tsb2kpes37b23ogjrb2kj4wgr7yncf4hhgsfahu7jad.onion 404 Not Found snapshot · 2025-02-02 17:00
aihvh6j6fbkfjyc6jqbsh2ed4s3rym2v2pu6kd3z3exdso2xc2qwcuqd.onion Index of / snapshot · 2025-03-25 08:09
gxp6yt3wdj7yky27j37jfrrbkuy24n2zo5uxyuoy23uf76d6m2gnfpid.onion Everest snapshot · 2025-10-20 13:07
everestndkvzcibcje2cqxhre2hmmybl3rn2gwzwsblz7gx6uryn5rad.onion Everest snapshot · 2026-08-06 21:10

Recent victims

The 50 most recent victims claimed by EVEREST. Total in the index: 496.

Date listed	Victim	Description
2026-08-05	Keysight	2 posts - 1h
2026-07-30	EPM	2 posts - Jul 6
2026-07-30	AKM Enterprises INC	1 posts - Jun 10
2026-07-30	Formulatrix	2 posts - Jul 6
2026-07-30	Oasis Legal Group	2 posts - Jul 6
2026-07-30	Conway Analytics	3 posts - Jul 7
2026-07-30	Greenbotz	2 posts - Jul 7
2026-07-30	NIMR Oil	2 posts - Jul 9
2026-07-30	TechCorr	2 posts - Jul 9
2026-07-30	Rodschinson Investment	2 posts - Jul 12
2026-07-30	Allied Telesis	2 posts - Jul 17
2026-07-30	Dharma Group	2 posts - Jul 17
2026-07-30	Emirates Flight Catering	2 posts - Jul 17
2026-07-30	Alzone Software	2 posts - Jul 18
2026-07-30	Rx Networks	2 posts - Jul 21
2026-07-30	Al-Futtaim Group	2 posts - Jul 21
2026-07-30	Aptara	2 posts - Jul 22
2026-07-30	Ingersoll Rand	2 posts - Jul 22
2026-07-30	Omnicell	2 posts - Jul 22
2026-07-30	Powerweave	2 posts - 6d
2026-07-30	Mansfield Family Dentistry	2 posts - 6d
2026-07-30	Stadler Rail	2 posts - yesterday
2026-05-29	ЕРМ
2026-05-29	Asopagos S.A.
2026-05-28	Spedition Kern
2026-05-28	Advanced Psychiatry Associates
2026-05-28	Sidra Kuwait Hospital
2026-05-28	VVO Finance
2026-05-28	AKM
2026-05-28	L&P Aesthetics
2026-05-28	TransferZ
2026-05-13	Citizens Bank - Database Leaked
2026-05-12	Studio Marchi - Studio Professionale Associato - Database Leaked
2026-05-12	Evaluate a Norstella company - Database Leaked
2026-05-07	Rehab Clinics Group Ltd
2026-05-07	K Subsea Group - Database Leaked
2026-05-07	Tokoparts - Database Leaked
2026-05-07	Super AI - Database Leaked
2026-05-07	Nutrabio - Database Leaked
2026-05-07	Complete Aircraft Group - Database Leaked
2026-05-05	Studio Marchi - Studio Professionale Associato
2026-05-03	Fiserv
2026-05-02	TSYS
2026-05-02	Epiq Global
2026-05-02	Symcor
2026-04-30	Liberty Mutual Insurance
2026-04-30	Umiles Group - Database Leaked
2026-04-30	Morae
2026-04-29	Indonesia's Customs Analytics Platform
2026-04-28	Super AI

← Back to Ransomtracker

Statistics on this page are computed by Ransomnews from a live leak-site monitoring feed. Numbers update every ten minutes. Operator-written victim descriptions are truncated and shown in snippet form only. Source data: RansomLook (CC BY 4.0), aggregated and adapted by Ransomnews.