Everest
A Russian-speaking criminal group active since about 2020 that makes money through data extortion, ransomware and selling access to other criminals. It also openly recruits insiders. Healthcare has been a repeated target, prompting a US government warning in 2024.
Threat actor profile. Last reviewed 3 November 2026.
Why It Matters
Everest does not rely on a single business model. The US health sector's HC3 centre described data extortion and ransomware alongside initial access broker activity, with access sold to other criminals.1,4 Since October 2023 it has also offered employees money for network access, according to Halcyon.2
Sources disagree on encryption, and this affects planning. Halcyon said in October 2025 that the group generally does not deploy encryption payloads,5 while Picus described an encryptor in July 2026.6 ZeroFox put the odds of encryption versus extortion alone at roughly even, and assessed that one February 2026 claim was very likely overstated.3
HC3 reported that healthcare was increasingly targeted from 2021.1 Halcyon later reported a rising focus on energy, aviation and telecoms.5 The sources reviewed do not establish confirmed UK victims. Halcyon mentions only an unverified UK claim.2
An insider offer is the unusual part of this group's playbook. We would make sure staff know how to report an approach, and treat a leak site claim as something to verify rather than assume.
How It Attacks
Combined from HC3 reporting,1 Halcyon2,5 and Picus.6 Not every intrusion includes every step, and some end in access resale or extortion alone.
- 1
Get Access
Uses weak or stolen credentials, exposed RDP without MFA, vulnerable VPNs, phishing, purchased access or a recruited insider.
- 2
Move Across the Network
Uses compromised accounts and RDP, with Cobalt Strike in support.
- 3
Gather More Credentials
Copies the LSASS process with ProcDump to extract further credentials.
- 4
Steal the Data
Archives data with tools such as WinRAR, and has breached supplier file-transfer systems.
- 5
Damage Recovery and Encrypt
Where the encryptor is used, deletes shadow copies, restore points and common backup files before encrypting.
- 6
Extort or Sell
Lists victims on a leak site with a deadline, may post stolen credentials, and sells access to others.
Key Techniques
ATT&CK v20 has no group entry for Everest. This mapping is ours, based on HC3 reporting,1 Halcyon2,5 and Picus.6
| ID | Technique | Tactic | What It Looks Like |
|---|---|---|---|
| T1078 | Valid Accounts | Initial Access | Uses weak, stolen or insider-supplied credentials. |
| T1133 | External Remote Services | Initial Access | Enters through exposed RDP and VPN services. |
| T1199 | Trusted Relationship | Initial Access | Has breached supplier-managed file-transfer systems. |
| T1021.001 | Remote Desktop Protocol | Lateral Movement | Moves across networks over RDP. |
| T1003.001 | LSASS Memory | Credential Access | Dumps LSASS with ProcDump. |
| T1560.001 | Archive via Utility | Collection | Compresses data with WinRAR. |
| T1490 | Inhibit System Recovery | Impact | Deletes shadow copies, restore points and backup files. |
| T1486 | Data Encrypted for Impact | Impact | Encrypts files in some intrusions. |
Tools Observed
Post-Exploitation
Discovery
Remote Access
Data Theft
Tool lists come from HC3 reporting,1 Halcyon2 and Picus.6 Several are legitimate products, so check whether a tool is approved and expected.
Vulnerabilities
Halcyon says no specific CVE exploitation has been observed for this group.2
Key Events
Warning Signs
Inferred from the reported tools and methods.1,2 None of these proves an attack alone.
- Unexpected Cobalt Strike activity on the network
- LSASS memory dumps or ProcDump on servers
- Logons over RDP from unusual sources
- An employee reporting an offer of money for access
- Large WinRAR archives on servers
Defences That Matter
Close the Common Doors
- Enforce MFA on RDP, VPN and remote tools.
- Remove exposed RDP where possible.
- Monitor for Cobalt Strike activity and apply mitigations from the HHS alert.4
Plan for Insiders
- Give staff a clear way to report approaches from criminals.
- Limit and log access to sensitive data.
Check Your Suppliers
- Review supplier-managed file-transfer systems and what data they hold, given reported supplier breaches.5
Verify Before You React
- Check a leak site claim against your own logs, as ZeroFox assessed one of its 2026 claims was very likely overstated.3
- Rehearse how you would respond to an extortion demand.
Would Your Staff Report an Offer From a Criminal?
We can review your access, insider and extortion response controls against the methods in this profile.
Sources
- GovInfoSecurity: US Authorities Warn Health Sector of Everest Gang Threats, 22 August 2024
- Halcyon: Everest threat group profile, updated 20 November 2025
- ZeroFox: Flash Report: Everest Continues to Tout Prominent Brands in Latest Disclosures, 6 February 2026
- American Hospital Association: HHS alerts health sector to cyberthreat from Everest ransomware group, 21 August 2024
- Halcyon: Everest Group Targeting Critical Infrastructure, 29 October 2025
- Picus Security: Everest Ransomware: Triple Threat of Encryption, Access, and Insiders, 10 July 2026
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK terms of use.