EVEREST Ransomware Gang: 3 New Victims Posted — German Manufacturing Hit, Sector Analysis & Detection Rules

Classification: TLP:CLEAR | Publication Date: 2026-09-08 | Source: ransomware.live dark web monitoring (EVEREST leak site) | Confidence: High (direct leak site observation)

Executive Summary

Between 2026-09-07 and 2026-09-08, the EVEREST ransomware operation posted three new victims to its Tor-based leak site: GGS (unclassified sector), KÖRBER (Manufacturing, Germany), and GENESILICO (Technology, Italy). All three postings occurred within a single 24-hour window, indicating either a coordinated disclosure batch following failed negotiations or a compressed intrusion-to-publication cycle. German and Italian enterprises in Manufacturing and Technology verticals should treat this as an active campaign signal and immediately review perimeter exposure — particularly Check Point gateways and remote access infrastructure — against the KEV-listed CVEs associated with this group's access broker ecosystem.

Threat Actor Profile — EVEREST

Key differentiator: EVEREST has blurred the line between ransomware crew and access broker. An EVEREST intrusion may terminate in encryption by a different family. Detection content must therefore target the pre-encryption intrusion tradecraft, not just a specific encryptor payload.

Current Campaign Analysis

Victim Postings (Leak Site, 2026-09-07)

Sector Targeting

Manufacturing and Technology dominate this batch. Manufacturing remains the highest-value target class for EVEREST due to: (1) low downtime tolerance in OT-adjacent environments creating payment pressure, (2) historically weaker endpoint coverage on plant-floor systems, and (3) valuable IP (process designs, CAD data) for extortion leverage. The KÖRBER posting — a large German industrial technology group — fits the gang's established pattern of pursuing mid-to-large industrial enterprises rather than small-business volume victims.

Geographic Concentration

Germany and Italy account for the confirmed-geography victims. This aligns with EVEREST's historical preference for DACH and Southern European targets alongside North America. German manufacturing firms in particular should elevate alert posture — EVEREST has repeatedly revisited this geography-sector pairing.

Victim Profile

Based on sector mix, estimated victim revenue band is $50M–$1B+ annually. KÖRBER represents the enterprise end of this band. EVEREST selects victims with demonstrated ability to pay, suggesting pre-intrusion reconnaissance (financial data harvesting via OSINT or broker-sourced victim lists).

Posting Frequency / Escalation

Three postings in a single day (with 3 of the last ~100 leak site entries clustering here) suggests either a batch of concurrent intrusions detonating near-simultaneously or a deliberate "pressure drop" publication strategy. Monitor the leak site over the next 72 hours — EVEREST typically follows batch postings with staged data sample releases.

CVE Correlation — Probable Initial Access Vectors

The following KEV-confirmed CVEs map directly to EVEREST's known access playbook and should be treated as priority patch/verify items:

• CVE-2026-50751 (Check Point Security Gateway — improper authentication in IKEv1 key exchange): VPN gateway compromise is a documented EVEREST entry vector. Any internet-facing Check Point appliance running vulnerable firmware is a critical exposure. Verify patch status today.
• CVE-2024-1708 (ConnectWise ScreenConnect — path traversal to RCE): MSP/RMM exploitation enables downstream victim access at scale. EVEREST affiliates have historically abused remote access tooling for both entry and persistence.
• CVE-2025-60710 (Windows link-following privilege escalation) and CVE-2023-21529 (Exchange deserialization RCE): Post-access privilege escalation and Exchange-based footholds respectively — both consistent with the gang's internal escalation chain.
• CVE-2026-48027 (Nx Console embedded malicious code): Supply chain vector; relevant to Technology-sector victims (cf. GENESILICO) with developer workstation exposure.

Assessment: The Check Point CVE (added to KEV 2026-06-08, three months before this campaign surfaced) is the highest-probability entry vector for the current intrusion set given EVEREST's appliance-exploitation history.

Detection Engineering

Sigma Rules

---
title: EVEREST - Check Point VPN Gateway Exploitation Followed by Suspicious Logon
title: Suspicious Authentication Anomaly After Check Point Gateway Access
date: 2026/09/08
modified: 2026/09/08
status: experimental
description: Detects external VPN/gateway authentication anomalies consistent with EVEREST initial access via exploited perimeter appliances (e.g., CVE-2026-50751). Looks for VPN logons from unusual geographies or at unusual hours followed by rapid internal authentication from the VPN-assigned session.
author: Security Arsenal Threat Intel
references:
    - https://securityarsenal.com/darkside
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    category: authentication
    product: checkpoint
    service: vpn
detection:
    selection_success:
        action|contains:
            - 'login'
            - 'authentication succeeded'
    filter_business_hours:
        - src_ip|cidr:
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
    condition: selection_success and not filter_business_hours
falsepositives:
    - Legitimate remote workers (tune with known user baseline and geo-velocity checks)
level: high
tags:
    - attack.initial_access
    - attack.t1133
    - attack.t1190
---
title: EVEREST - RDP Brute Force Followed by Successful Logon
date: 2026/09/08
modified: 2026/09/08
status: experimental
description: Detects RDP brute force patterns (multiple failed type-3/type-10 logons) followed by a successful interactive or remote-interactive logon from the same source — consistent with EVEREST exposed-RDP initial access tradecraft.
author: Security Arsenal Threat Intel
references:
    - https://securityarsenal.com/darkside
logsource:
    product: windows
    service: security
detection:
    selection_failed:
        EventID: 4625
        LogonType:
            - 3
            - 10
        Status: '0xC000006A'
    selection_success:
        EventID: 4624
        LogonType:
            - 10
    timeframe: 10m
    condition: selection_failed | count() by IpAddress > 5
falsepositives:
    - Misconfigured service accounts
    - Password spray by legitimate scanners (verify source)
level: high
tags:
    - attack.credential_access
    - attack.t1110
    - attack.t1021.001
---
title: EVEREST - Pre-Encryption Staging - Shadow Copy Deletion and PsExec/WMI Lateral Movement
date: 2026/09/08
modified: 2026/09/08
status: experimental
description: Detects the classic EVEREST pre-detonation chain — Volume Shadow Copy deletion (vssadmin/wmic/bcdedit) combined with remote service creation or WMI process execution used for lateral movement and payload push prior to encryption.
author: Security Arsenal Threat Intel
references:
    - https://securityarsenal.com/darkside
logsource:
    category: process_creation
    product: windows
detection:
    selection_vss:
        - Image|endswith: '\vssadmin.exe'
          CommandLine|contains:
            - 'delete shadows'
            - 'Delete Shadows'
        - Image|endswith: '\wmic.exe'
          CommandLine|contains: 'shadowcopy delete'
        - Image|endswith: '\bcdedit.exe'
          CommandLine|contains:
            - 'recoveryenabled no'
            - 'bootstatuspolicy ignoreallfailures'
    selection_lateral:
        - Image|endswith: '\psexec.exe'
        - Image|endswith: '\psexesvc.exe'
        - ParentImage|endswith: '\wmiprvse.exe'
          CommandLine|contains:
            - 'cmd.exe'
            - 'powershell'
            - 'rundll32'
    condition: 1 of selection_vss or 1 of selection_lateral
falsepositives:
    - Legitimate admin tooling (PsExec in managed environments) - whitelist known admin hosts
    - Backup software shadow copy management
level: critical
tags:
    - attack.impact
    - attack.t1490
    - attack.t1569.002
    - attack.t1047
    - attack.lateral_movement

KQL — Microsoft Sentinel Hunt Query

Hunts for the EVEREST pre-ransomware staging pattern: shadow copy tampering, mass file staging to temp/archive locations, suspicious remote service installs, and RMM-tool execution — within a rolling 7-day window.

let lookback = 7d;
let vssEvents = DeviceProcessEvents
| where Timestamp > ago(lookback)
| where (FileName =~ "vssadmin.exe" and ProcessCommandLine has "delete shadows")
   or (FileName =~ "wmic.exe" and ProcessCommandLine has "shadowcopy")
   or (FileName =~ "bcdedit.exe" and ProcessCommandLine has "recoveryenabled")
| project VssTime=Timestamp, DeviceName, AccountName, VssCmd=ProcessCommandLine, InitiatingProcessFileName;
let lateralEvents = DeviceEvents
| where Timestamp > ago(lookback)
| where ActionType == "ServiceInstalled"
   and (AdditionalFields has "psexec" or AdditionalFields has "paexec" or AdditionalFields has "svc.exe")
| project LateralTime=Timestamp, DeviceName, ServiceInfo=AdditionalFields;
let rmmEvents = DeviceProcessEvents
| where Timestamp > ago(lookback)
| where FileName has_any ("ScreenConnect", "anydesk.exe", "teamviewer.exe", "splashtop", "atera")
   and InitiatingProcessFileName !in~ ("msiexec.exe", "sccmhost.exe")
| project RmmTime=Timestamp, DeviceName, RmmTool=FileName, RmmCmd=ProcessCommandLine;
let stagingEvents = DeviceFileEvents
| where Timestamp > ago(lookback)
| where FolderPath has_any ("\\Temp\\", "\\ProgramData\\")
   and FileName endswith_any (".zip", ".7z", ".rar")
| summarize ArchiveCount=count(), FirstArchive=min(Timestamp) by DeviceName
| where ArchiveCount > 20;
vssEvents
| join kind=inner (stagingEvents) on DeviceName
| join kind=leftouter (lateralEvents) on DeviceName
| join kind=leftouter (rmmEvents) on DeviceName
| project DeviceName, AccountName, VssTime, VssCmd, ArchiveCount, FirstArchive, LateralTime, RmmTime, RmmTool
| order by VssTime asc

Analyst note: Any host hitting the VSS-deletion branch and the mass-archive branch within 24 hours should be treated as an imminent encryption event — escalate to IR immediately, do not wait for corroboration.

PowerShell — Rapid Response Exposure & Staging Check

Run on suspected hosts or via remote invocation across the estate. Checks for: exposed RDP listeners, scheduled tasks created in the last 7 days (common EVEREST persistence), shadow copy status, and recently added local admins.

# EVEREST Rapid Triage Script - run elevated
$cutoff = (Get-Date).AddDays(-7)
Write-Host "=== [1] RDP Exposure Check ===" -ForegroundColor Cyan
$rdp = Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue
if ($rdp.fDenyTSConnections -eq 0) {
    $nla = Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue
    Write-Warning "RDP ENABLED. NLA=$( $nla.UserAuthentication ) (1=required, 0=NOT required - HIGH RISK)"
} else { Write-Host "RDP disabled." -ForegroundColor Green }

Write-Host "=== [2] Scheduled Tasks Created in Last 7 Days ===" -ForegroundColor Cyan
Get-ScheduledTask | Where-Object { $_.Date -gt $cutoff -and $_.TaskPath -notlike '\Microsoft\*' } |
  Select-Object TaskName, TaskPath, Date, @{N='Action';E={$_.Actions.Execute}} | Format-Table -AutoSize

Write-Host "=== [3] Volume Shadow Copy Status ===" -ForegroundColor Cyan
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) { Write-Warning "NO SHADOW COPIES FOUND - possible vssadmin deletion (EVEREST pre-encryption TTP)" }
else { $shadows | Select-Object DeviceObject, InstallDate | Format-Table -AutoSize }

Write-Host "=== [4] Local Admin Additions in Last 7 Days ===" -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4732; StartTime=$cutoff} -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match 'Administrators' } |
  Select-Object TimeCreated, Message | Format-List

Write-Host "=== [5] Suspicious Remote Services (PsExec-style) ===" -ForegroundColor Cyan
Get-CimInstance Win32_Service | Where-Object { $_.PathName -match 'psexec|paexec|ADMIN\$|\\\\.*\\.*\.exe' } |
  Select-Object Name, State, PathName, StartName | Format-Table -AutoSize

Write-Host "=== [6] Recent RMM Tool Artifacts ===" -ForegroundColor Cyan
Get-ChildItem 'C:\ProgramData','C:\Program Files','C:\Program Files (x86)' -Directory -ErrorAction SilentlyContinue |
  Where-Object { $_.Name -match 'ScreenConnect|AnyDesk|Atera|Splashtop|TeamViewer' -and $_.CreationTime -gt $cutoff } |
  Select-Object FullName, CreationTime

Incident Response Priorities

T-Minus Detection Checklist (Before Encryption Fires)

1. vssadmin / bcdedit / wmic shadowcopy execution on any server — treat as pre-detonation, not admin noise, until proven otherwise.
2. Mass archive creation (.zip/.7z/.rar) in user-writable temp paths, especially on file servers and executive workstations.
3. New scheduled tasks or services with encoded/obfuscated commands or random names.
4. RMM tooling present that your org does not license (ScreenConnect, AnyDesk, Atera) — EVEREST's favorite persistence-and-push channel.
5. Outbound spikes to MEGA, Dropbox, file.io, or anonymous FTP from server VLANs — exfil precedes leak posting by days.
6. VPN sessions from impossible-travel geographies on Check Point / perimeter appliances, particularly IKEv1-authenticated sessions.

Critical Assets EVEREST Prioritizes for Exfiltration

• File shares containing financial records, contracts, and HR data (used for extortion leverage and victim-shaming)
• Engineering/IP repositories — CAD files, process documentation, R&D data (particularly in manufacturing victims like KÖRBER)
• Executive mailboxes and legal correspondence
• Domain controller NTDS.dit and backup catalogs (also enables full-environment encryption)

Containment Actions — Ordered by Urgency

1. Isolate affected hosts/VLANs at the switch or EDR level — do not power off (preserve memory for forensic artifact capture).
2. Disable compromised VPN accounts and force global credential reset, prioritizing accounts with recent gateway logons.
3. Block known exfil destinations at egress proxy/firewall; enable TLS inspection logging for large outbound transfers if not already active.
4. Kill persistence: remove unauthorized RMM agents, rogue scheduled tasks, and newly created local admin accounts.
5. Snapshot domain controllers and critical servers (hypervisor-level) before any remediation that alters disk state.
6. Engage IR retainer before contacting the actor; leak-site negotiation with EVEREST has historically not prevented publication.

Hardening Recommendations

Immediate (24 Hours)

• Patch Check Point Security Gateways against CVE-2026-50751 (improper authentication in IKEv1). If patching is not possible within 24h, disable IKEv1 key exchange and restrict gateway management interfaces to allow-listed admin IPs.
• Audit and patch ConnectWise ScreenConnect (CVE-2024-1708) across your environment and all MSPs with access to your network. Remove unauthorized instances outright.
• Block RDP from the internet entirely; place any required remote access behind VPN + MFA + NLA.
• Deploy the Sigma rules and KQL query above to your SIEM; set the shadow-copy/lateral-movement rule to page on-call.
• Restrict vssadmin/bcdedit/wmic execution via AppLocker/WDAC for non-admin contexts and alert on any execution.

Short-Term (2 Weeks)

• Enforce phishing-resistant MFA (FIDO2) on all remote access, VPN, and privileged accounts.
• Segment manufacturing/OT-adjacent networks from corporate IT with deny-by-default east-west rules — KÖRBER-style industrial victims are breached via IT pivot, not OT directly.
• Implement egress data loss controls: alert/block outbound transfers >1GB to unsanctioned cloud storage; require proxy authentication for server VLANs.
• Immutable, offline backups with tested restore runbooks; verify backup infrastructure is unreachable from production credentials.
• Contractually require MSP/RMM security baselines — the ScreenConnect exploitation pattern shows third-party tooling is a primary blast-radius multiplier.
• Hunt retroactively: run the KQL query across 30 days of data; EVEREST dwell time means an active intrusion today may not post to the leak site until October.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub