Article
Check-in outage: one supplier, many airports
The Collins Aerospace MUSE outage pushed European airports into manual check-in. Here is what a security buyer should ask about shared supplier systems.
Read more
Ransomware group profile
Everest
Also known as Everest ransomware group, EverBe 2.0 (earlier family, per HHS HC3)
Everest is a financially motivated ransomware and data extortion group.
- Active
In short
Everest is a financially motivated ransomware and data extortion group. The US Department of Health and Human Services (HHS) says it has been active since 2020, steals and threatens to publish data, runs ransomware, and also acts as an initial access broker, meaning it sells entry into company networks to other criminals.
- StatusActiveas reported
- Other Names2names in public reportsEverest ransomware group
- Entry Routes3ways inInsecure external services · Stolen or weak credentials
- Techniques7mapped to MITRE ATT&CKExternal Remote Services · Remote Services
- Defences6first steps listedKeep offline backups · Close unused remote access
Overview
Everest is a criminal group that steals data, encrypts systems and sells access to company networks. The best official description we could open is a threat profile from the US Department of Health and Human Services (HHS) Health Sector Cybersecurity Coordination Center (HC3), dated 20 August 2024. It says the group has been active since 2020 and has gone through several forms.
A note on sources: official material on Everest is thin. HHS HC3 is the only government document we could open that profiles the group. MITRE ATT&CK has no Everest group or software entry, and we found no CISA or FBI #StopRansomware advisory, no indictment and no takedown notice about it. Facts below are limited to what HC3 and MITRE pages say, with the date. The HC3 profile is from August 2024, so check stopransomware.gov and your national cyber agency for newer statements.
What is the Everest ransomware group?
HC3 says Everest has been around since at least December 2020. It first focused on stealing data and later moved to ransomware. HC3 adds that the group has done initial access broker work, which means selling a foothold in a victim network to someone else, since at least November 2021, and increasingly specialized in it in 2023. The same document says the ransomware strain was previously linked to a Russia-based ransomware operation and that researchers have linked Everest to the BlackByte group.
Who does Everest attack?
HC3 reports that the group had claimed 120 victims on its leak site as of 15 July 2024, according to a trusted third party. About a third of the victims were in the United States. The most affected industries were construction and engineering, financial services, legal and professional services, healthcare and government. HC3 counts nearly 20 healthcare incidents from April 2021 to July 2024, says the group disproportionately targeted medical imaging providers in the United States, and says the yearly number of health sector incidents has risen by about one per year since 2021. We do not name victims.
How does an Everest intrusion work?
HC3 describes a hands-on intrusion. The operators reach networks through insecure external services and move sideways with legitimate stolen accounts and Remote Desktop Protocol. They copy the memory of the Windows security process (LSASS) with ProcDump and copy the Active Directory database (NTDS) to harvest more passwords. They scan the network with discovery tools, pack data with WinRAR on file servers and send it out using the file transfer feature of remote access tools. Cobalt Strike is their main command channel, with AnyDesk, Splashtop and Atera as backups. They delete their tools and output files as they go. Files are encrypted with AES and DES and renamed with the .EVEREST extension. HC3 said in 2024 that no public decryptor was available.
Does Everest buy access from insiders?
HC3 notes that in October 2023 open-source reports said people linked to Everest were offering corporate insiders cash for remote access. It also warns that such adverts are common for access brokers and do not necessarily show that Everest was seeking out insiders. Treat it as a reason to watch for access sales and unusual remote logins, not as proof of insider recruitment.
- December 2020Active since at leastHHS HC3 dates the group to at least December 2020.
- April 2021First health sector incident in HC3 countHC3 counts nearly 20 health sector incidents from April 2021 to July 2024.
- May 2021Leak site goes offlineHC3 says the data leak site became unreachable after a high profile attack on a US fuel transport company.
- November 2021First seen as access brokerHC3 says Everest was first observed acting as an initial access broker.
- 2023Specializes in access brokeringHC3 says the group increasingly specialized in this role.
- October 2023Insider access offers reportedHC3 cites open-source reports and warns about reading too much into them.
- 15 July 2024120 leak site victimsHC3 cites a trusted third party for the count.
- 20 August 2024HHS HC3 threat profileThe profile gives tools, techniques and mitigations.
- Active since
- At least December 2020 (HHS HC3)
- Activity
- Data extortion, ransomware and initial access brokering
- File extension
- .EVEREST
- Main command tool
- Cobalt Strike
- Leak site victims
- 120 as of 15 July 2024 (HC3, third-party count)
- Most affected industries
- Construction and engineering, financial services, legal and professional services, healthcare, government
- Official advisory
- HHS HC3 profile, 20 August 2024; no CISA or FBI advisory found
Law enforcement action
The official sources opened for this page do not describe an arrest, takedown, sanction or indictment of Everest. HC3 itself points readers to CISA’s Stop Ransomware pages, the FBI and the Internet Crime Complaint Center for reporting and help.
Also known as
- Everest ransomware group
- EverBe 2.0 (earlier family, per HHS HC3)
How they get in
-
01
Insecure external services
HC3 lists initial access through an insecure external service (MITRE T1133). It does not name a product or a CVE.
-
02
Access bought from other criminals
HC3 says Everest has acted as an initial access broker, and notes that accesses such as RDP with VPN are commonly bought from other actors. The group has advertised that it wants access in the US, Canada and Europe.
-
03
Stolen or weak credentials
HC3 says the group uses legitimate compromised accounts and Remote Desktop Protocol to move through networks, and that weak or stolen credentials give it access to many systems.
How they extort
Data theft and ransomware, per HHS HC3 (August 2024): the group encrypts files, renames them with the .EVEREST extension and threatens to publish stolen data on its leak site. It has also sold network access to other actors.
Who they target
-
01
Financial services
See the industry page -
02
Healthcare
See the industry page -
03
Government
See the industry page -
04
Construction and engineering
-
05
Legal and professional services
Tools and malware
Techniques
- Technique Application Layer Protocol Application Layer Protocol is a technique where attackers talk to a system they control using ordinary network protocols, such as those used for web browsing, file transfer, email or DNS. T1071 · Command and Control
- Technique Archive Collected Data Archive collected data is when an attacker packs stolen files into compressed or encrypted bundles before sending them out. T1560 · Collection
- Technique Data Encrypted for Impact Data Encrypted for Impact is when attackers encrypt files or whole systems so the owner can no longer use them, and then hold back the key. T1486 · Impact
- Technique Exfiltration Over C2 Channel Exfiltration over a C2 channel is when an attacker sends stolen data out through the same channel they already use to control the infected system. T1041 · Exfiltration
- Technique External Remote Services External Remote Services is a technique where an attacker uses a remote access service that faces the internet, such as a VPN or Citrix, to enter a network or to keep access to it. T1133 · Persistence, Initial Access
- Technique OS Credential Dumping OS credential dumping is when an attacker pulls account login material out of a computer. T1003 · Credential Access
- Technique Remote Services Remote Services is when an attacker uses a valid account to log in to a service built for remote access, such as SSH, RDP or VNC. T1021 · Lateral Movement
How to defend
-
Keep offline backups
Back up data, air gap and password-protect backup copies offline so critical data cannot be changed or deleted from the system where it lives (FBI steps in the HC3 profile).
-
Close unused remote access
Disable unused remote access and Remote Desktop Protocol ports, and monitor remote access and RDP logs. Everest uses RDP and remote tools to move and to stay.
-
Use multi-factor authentication
Use MFA where possible and change passwords regularly without reusing them. Everest relies on stolen or weak credentials.
-
Segment the network
Network segmentation limits how far a group that moves by RDP can spread.
-
Watch for tampering and new tools
Review anti-virus logs for signs it was turned off, require administrator credentials to install software, and review accounts for new or unrecognized users.
-
Audit administrator accounts
Audit accounts with administrative privileges and apply least privilege, because the group copies the memory of the security process and the Active Directory database.
Questions
What is the Everest ransomware group?
Everest is a criminal group that steals data, runs ransomware and sells access to company networks. The US Department of Health and Human Services (HHS) HC3 says it has been active since 2020 and, in a profile dated 20 August 2024, describes its tools, techniques and targets.
Is Everest a ransomware group or an access broker?
Both, according to HHS HC3. It says Everest has done data extortion, ransomware and initial access broker work, and that it increasingly specialized in selling access in 2023.
What does Everest do to a network?
HC3 describes stolen accounts and Remote Desktop Protocol for movement, ProcDump to copy security process memory, WinRAR to pack data, remote tools to send it out, Cobalt Strike for control, then AES and DES encryption with the .EVEREST extension.
Who does Everest target?
HC3 says the leak site listed 120 victims as of 15 July 2024, about a third in the United States, mostly in construction and engineering, financial services, legal and professional services, healthcare and government. Medical imaging providers in the US were disproportionately hit.
Is there a government advisory about Everest?
The only one we could open is the HHS HC3 threat profile from August 2024. We found no CISA or FBI #StopRansomware advisory, no MITRE ATT&CK group entry and no indictment or takedown notice.
How can a company defend against Everest?
Keep offline backups, close unused Remote Desktop ports and watch their logs, use multi-factor authentication, segment the network, audit administrator accounts and check that security software has not been switched off. These come from the FBI steps listed in the HC3 profile.
In our research
Sources
- Threat Actor Profile: Everest Ransomware Group (HC3, 20 August 2024, copy hosted by the American Hospital Association) US Department of Health and Human Services, HC3
- Cobalt Strike, Software S0154 MITRE ATT&CK
- Data Encrypted for Impact, Technique T1486 MITRE ATT&CK
- #StopRansomware Guide CISA
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.