everest

Tácticas y técnicas observadas del actor, mapeadas a MITRE ATT&CK (clic para ver la ficha oficial). Útil para priorizar detecciones.

Para detección/bloqueo en tu EDR/SIEM. Fuente: ransomware.live.

Firma de detección defensiva para este grupo (úsala en tu EDR/SIEM). Fuente: ransomware.live.

/*
Everest ransomware / data extortion
*/

rule Everest_Ransomnote
{
    meta:
        author = "ransomware.live"
        family = "ransomware.everest"
        description = "Detects Everest ransomware ransom note"
        date = "2026-05-04"
        severity = 7
        score = 70

    strings:
        $s1 = "@Everest Read Me.txt" ascii nocase
        $s2 = "Everest" ascii
        $s3 = "everestteam" ascii nocase
        $s4 = "everest.team" ascii nocase

    condition:
        any of them
}

Dear [snip],
Greetings from the Everest team. Your systems have been attacked, the files are encrypted. You can read about us in our blog (Tor browser needed)
Blog : [redactado]
Or read about our group in Twitter
Also, our team was able to bypass your "Dataprotection" as any other your protection software and more than 1 Terabyte of internal files were exfiltrated to our servers, which we can confirm with great joy and ease
The list contains financial documents, internal orders, KYC information(documents,photos...), trusted representatives personal info
Client risk levels,loans, debt and client data. Various financial documentation, backups , etc. etc.
The information was collected both from personal PCs and from centralized storage locations.
If an agreement is reached with us, this information will never be published and the problem will disappear as if it never happened, otherwise it will be posted on our blog and darknet. Which will lead to even greater financial and reputational losses on your part.
Also you will get
1.Attack logbook (months of experience with your company) with full list of vulnerabilities and bypass methods
2.Advices how to singifically improve your security and avoid such attacks in the future
3.We will delete all files from your company
4.We will attack your company no more
Yours trully Everest Team
Email to contact: [redactado]
Your key:
[snip]

• https://www.ransomware.live/group/everest
• https://www.zscaler.com/blogs/security-research/everest-ransomware-extortion
• https://www.trellix.com/en-us/about/newsroom/stories/research/everest-ransomware-gang-offers-access-to-compromised-networks.html
• https://www.bleepingcomputer.com/news/security/everest-ransomware-now-selling-company-data-on-hacker-forums/

• Technology
  8
• Healthcare
  6
• Professional Services
  6
• Energy & Utilities
  4