Group profile
everest
Everest ransom group collects and analyzes information about their victims. They specialize in customer privacy data, financial information, databases, credit card information, and more. The Everest ransom group leaks the victim's data to the darknet and they announced that any victim that will not contact them will suffer from a data leak and they will not delete hist files for future usage.
Sectors hit
- Unspecified
- Healthcare
- Transportation/Logistics
- Technology
- Professional Services
- Financial Services
- Other
- Consumer Services
Countries hit
MITRE ATT&CK · observed TTPs
- TA0005Stealth
- T1027Obfuscated Files or Information
Binary protected with ConfuserEx: rename obfuscation, constants encryption, integer confusion, and modified module .cctor.
- T1027.007Obfuscated Files or Information: Dynamic API Resolution
All non-corlib native API calls resolved at runtime via LoadLibrary / GetProcAddress rather than static imports.
- T1078.003Valid Accounts: Local Accounts
Implicit current-user impersonation used for net use \\<unc> connections to discovered network shares without explicit credential passing.
- T1112Modify Registry
Multiple HKCU/HKLM registry writes: LongPathsEnabled, LocalAccountTokenFilterPolicy, EnableLinkedConnections (share access), WallPaper (ransom note), AppName\PublicKey (encryption key storage).
- T1140Deobfuscate/Decode Files or Information
Runtime decryption of UserStrings via <Module>.m using GZip decompression followed by Base64 decoding.
- T1480Execution Guardrails
Global <GUID> mutex enforces single-instance execution; CIS culture/LCID geo-fence prevents execution on CIS-locale systems.
- T1564Hide Artifacts
Process self-DACL set to deny-Everyone via KZsyzkgZlDQw.UB, preventing other processes from inspecting or terminating the ransomware process.
- T1622Debugger Evasion
Memory-pig killer heuristic: processes consuming more than 250 MB are terminated, targeting sandbox environments and active debuggers.
- TA0007Discovery
- T1018Remote System Discovery
ARP table parsed via arp -a; ARP-driven Wake-On-LAN packets sent to discovered hosts to bring them online before encryption.
- T1135Network Share Discovery
Network shares enumerated via net view, NetDfsEnum, WNetEnumResource*, Win32_Share WMI class, and Win32_NetworkConnection.
- T1518.001Software Discovery: Security Software Discovery
Anti-analysis kill list matched against ProcessName and MainWindowTitle to identify and terminate security/analysis tools.
- T1614.001System Location Discovery: System Language Discovery
CIS culture/LCID check used as exclusion geo-fence; execution aborts if system locale matches CIS-region languages.
- TA0008Lateral Movement
- T1021.002Remote Services: SMB/Windows Admin Shares
net.exe use \\<unc> executed over discovered SMB shares to access and encrypt remote file systems.
- TA0011Command and Control
- T1071.001Application Layer Protocol: Web Protocols
WebClient.DownloadData referenced in Helpers.DownloadUrl — present in code but not reachable at runtime (inert code path).
- TA0040Impact
- T1486Data Encrypted for Impact
AES-128-CBC PKCS#7 / NoPadding (large files) encryption of all eligible files on local drives, mounted unlettered volumes, and LAN shares.
- T1489Service Stop
ServiceController.Stop called against ~100 services (AV, backup, MSSQL, Exchange, MBAM, Veeam, Acronis, etc.) combined with sc config <svc> start=disabled to prevent restart.
- T1490Inhibit System Recovery
VSS deletion via PowerShell or vssadmin, SRRemoveRestorePoint, backup file deletion (del /s /q), Recycle Bin removal (rd /s /q), Restart Manager used to force-shutdown apps locking target files.
CCA Bank
Capgemini Engineering
Grupo DT
Kingston Technology
Experts Entreprendre
Kingston Technology
Kingston Technology is a privately held American company founded in 1987 and headquartered in Fountain Valley, California. It is one of the world's largest manufacturers of memory products, including DRAM modules, flash storage, USB drives, and solid-state drives. Kingston serves consumer, enterprise, and embedded markets globally, supplying components to major OEMs and retail customers across the technology industry.
Experts Entreprendre
Grupo DT
Capgemini Engineering
Capgemini Engineering is a global technology and engineering services company headquartered in France. It provides R&D and engineering outsourcing services across industries including aerospace, automotive, telecommunications, energy, and semiconductors. Operating in over 30 countries, it combines software, hardware, and connected systems expertise to help clients design, develop, and deploy innovative products and digital solutions.
Keysight
Keysight Technologies is an American electronic test and measurement company headquartered in Santa Rosa, California. It designs and manufactures instruments, software, and services used to design, emulate, and test electronic equipment. Its solutions support industries including aerospace, defense, communications, semiconductors, and automotive. Formerly part of Agilent Technologies, Keysight became an independent public company in 2014.
Keysight
EPM
AKM Enterprises INC
Formulatrix
Oasis Legal Group
Conway Analytics
Greenbotz
NIMR Oil
TechCorr
Rodschinson Investment
Allied Telesis
Dharma Group
Emirates Flight Catering
Alzone Software
Rx Networks
Al-Futtaim Group
Aptara
Ingersoll Rand
Omnicell
Covered · WTOP DC →Powerweave
Mansfield Family Dentistry
Stadler Rail
ЕРМ
Asopagos S.A.
Asopagos S.A.
ЕРМ
Spedition Kern
Advanced Psychiatry Associates
Sidra Kuwait Hospital
VVO Finance
AKM
L&P Aesthetics
TransferZ
Spedition Kern
Advanced Psychiatry Associates
Advanced Psychiatry Associates is a psychiatric medical practice based in the United States. The company provides comprehensive mental health services, including evaluation, diagnosis, and treatment of psychiatric conditions such as depression, anxiety, ADHD, and bipolar disorder. It operates within the healthcare and behavioral health industry, offering both medication management and therapy services to adult and adolescent patients across its clinic locations.
Sidra Kuwait Hospital
Sidra Kuwait Hospital is a private healthcare facility located in Kuwait. It provides a range of medical and clinical services to patients, including diagnostics, outpatient consultations, and specialized treatments. Operating within the private healthcare sector in Kuwait, the hospital serves both local residents and expatriates, contributing to the country's growing private medical infrastructure alongside public health institutions.
VVO Finance
AKM
N/A There are multiple companies with the acronym "AKM" across various industries and countries, and without additional context (such as full company name, industry sector, or country), I cannot reliably identify which specific organization is being referenced or provide accurate threat intelligence details.