Incidents

Everest

Review this actor's tracked leak-site claims, published reporting, and attributed threat evidence.

ransomware539 leak-site claims, all timeLatest observed leak-site post 2026-10-27

ORKL search ↗

Portable threat brief

Everest

Facts from stored data only; no AI-written text.

Opens the browser print dialog; choose Save as PDF.

Executive facts

Actor: Everest
Kind: ransomware
Actor record created: 2026-07-30
Latest observed: 2026-10-27
Leak-site claims: 539
Catalogued techniques: 0

Scope

Tracked sectors: Healthcare, Financial Services, Legal, Energy & Utilities, Business & Professional Services
Claim records: 2021-09-09 to 2026-10-27
News stories naming this group: 2026-07-22 to 2026-09-24

Vulnerability events linked to this group

No dated vulnerability events are attached to this group's linked vulnerabilities.

Verified techniques

No verified ATT&CK mapping for this group.

Defensive actions

No defensive actions are attached to this profile.

Most-claimed sectorsHealthcareFinancial ServicesLegalEnergy & UtilitiesBusiness & Professional Services

Activity window in this site's data

This is only the dates observed by this site. It is not this actor's lifetime or evidence of dormancy outside these dates.

Claim records: First observed 2021-09-09Latest observed 2026-10-27
News stories naming this group: First observed 2026-07-22Latest observed 2026-09-24

Verified ATT&CK phases represented

No verified ATT&CK mapping for this group

Origin and motivation

Origin and motivation not attributed.

No MITRE ATT&CK group mapping exists for this actor yet. Mappings here are strict: an actor links to a MITRE group only when the group's own name, aliases, or MITRE-published description match, and MITRE has not catalogued this group. Technique and defensive action data will appear automatically if a verified mapping lands.

Claims posted under this group's name or leak-site brand

539 on this site

Energy Storage Terminal in SingaporeEnergy & Utilities2026-10-27source ↗
TECNA ICESector not stated by source2026-10-27source ↗
MediSolutionHealthcare2026-10-27source ↗
SleepEx LabRetrieverSector not stated by source2026-10-27source ↗
OR TechnologySector not stated by source2026-10-27source ↗
Burris & MacOmberSector not stated by source2026-10-27source ↗
Point RoboticsTechnology2026-10-27source ↗
NatuzziRetail2026-10-27source ↗
PWCBusiness & Professional Services2026-10-22source ↗
Linebarger Goggan Blair & SampsonBusiness & Professional Services2026-10-22source ↗

View all on Breaches →

Leak-site claim activity

Claims per month, 2021-09 to 2026-10. Peak 31 in 2026-02.

2021-092026-10

Show monthly counts as a table

Month	Claims
2021-09	17
2021-10	3
2021-11	9
2021-12	5
2022-01	5
2022-02	3
2022-03	18
2022-04	5
2022-05	3
2022-06	3
2022-07	7
2022-08	2
2022-09	5
2022-10	20
2022-11	3
2022-12	0
2023-01	0
2023-02	0
2023-03	2
2023-04	4
2023-05	0
2023-06	1
2023-07	2
2023-08	19
2023-09	5
2023-10	1
2023-11	1
2023-12	1
2024-01	2
2024-02	2
2024-03	3
2024-04	3
2024-05	7
2024-06	11
2024-07	8
2024-08	7
2024-09	4
2024-10	6
2024-11	18
2024-12	12
2025-01	14
2025-02	4
2025-03	1
2025-04	1
2025-05	9
2025-06	8
2025-07	20
2025-08	15
2025-09	11
2025-10	15
2025-11	27
2025-12	16
2026-01	21
2026-02	31
2026-03	10
2026-04	16
2026-05	23
2026-06	0
2026-07	21
2026-08	6
2026-09	13
2026-10	30

0 additional claims without a disclosure date

News stories naming this group

5 on this site

2026-09-24breaches incidentsSomeone went shopping in ASUS's eShop – for customer data
2026-09-15ransomwareSwiss court sentences 52-year-old Ukrainian ransomware dev to nearly 13 years in the cooler
2026-07-27vulnerabilities27th July – Threat Intelligence Report
2026-07-22ransomwareSwiss train maker Stadler refuses Everest $12 million ransomware demand
2026-07-22ransomwareSwiss rail giant Stadler rejects $12.3M ransom demand after cyberattack

Ransomware claim data is unverified: RansomLook (CC BY 4.0) and ransomware.live (Terms of use: credit and link required).