Profile of Everest
|by Alpha Team
Profile of Everest
TLP: AMBER
In the following profile, ZeroFox Intelligence provides an overview on the Everest ransomware group.
Standing Intelligence Requirements
For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:
https://cloud.zerofox.com/alpha_team/advisories/14956
Link to Download
Executive Summary
Everest is a Russian-language ransomware collective that has historically targeted organizations by encrypting and exfiltrating data to be used in ransom demands or to sell to third parties. Everest is believed to have been developed from the Everbe ransomware strain—active between late 2018 to 2020—which has also included Embrace, EvilLocker, Hyena Locker, and PainLocker. However, it is not clear if Everest is a rebrand or just utilizes similar code and tactics. Everest, in its current guise, was identified as early as 2020 but raised its profile significantly in June 2021 after conducting a series of attacks against French companies across multiple industries.1 This was followed by an uptick in activity with an expanded scope of targets. Everest claims that it has breached several organizations and entities globally towards the end of 2021 and into early 2022, including departments of the UK and U.S. governments. ZeroFox has been unable to confirm the veracity of some of Everest’s claims.
Tags: MAL Ransomware, DDW Ransomware, malware, all industries, global, vulnerability/exploit, threat actor