EVEREST Ransomware Gang: 4 New Victims Posted in Single-Day Surge — Tech & Professional Services Targeting Analysis with Detection Rules

Classification: TLP:CLEAR | Published: 2026-08-20 | Source: ransomware.live dark web monitoring | Analyst: Security Arsenal — From The Dark Side

1. Threat Actor Profile — EVEREST

EVEREST is one of the longest-running extortion operations in the ransomware ecosystem, active since at least late 2020 and continuously evolving its tradecraft.

• Aliases / related branding: EVEREST Ransomware Team; historically linked through tooling and infrastructure overlaps with the BlackByte ecosystem and earlier EverBe ransomware code lineage. The group also operates an auction model, selling access and stolen data on underground forums rather than always leaking it.
• Operating model: Hybrid closed-group / affiliate-lite. Unlike pure RaaS programs (LockBit, BlackCat), EVEREST maintains a tight core team but has historically purchased initial access from IABs (Initial Access Brokers) rather than recruiting a broad affiliate base. This produces lower victim volume but higher-value targets.
• Ransom demands: Typically range from $200K to $4M USD, scaled to victim revenue. The group is known to negotiate aggressively and to publish partial data as pressure escalates.
• Initial access methods: Compromised VPN appliances and perimeter devices (historically Fortinet and Pulse Secure; current KEV data suggests Check Point), purchased RDP/VPN credentials from brokers, spearphishing with macro-laden documents, and exploitation of remote access tooling (ScreenConnect-class RMM abuse).
• Extortion approach: Classic double extortion — exfiltration first, encryption second, with a public leak site used for staged data releases. EVEREST is notable for occasionally skipping encryption entirely and operating as a pure data-extortion crew when access allows.
• Dwell time: Observed median 7–21 days between initial access and detonation, with exfiltration typically beginning within 72 hours of establishing persistence.

2. Current Campaign Analysis

Victim Postings (2026-08-20)

Sector Targeting

The campaign shows a clear dual-track focus: Technology (high-value IP, supply chain leverage — Kingston is a household-name hardware vendor) and Professional Services / Engineering (firms holding concentrated third-party client data — Capgemini Engineering is a trophy target with downstream breach implications for hundreds of enterprise clients). This is consistent with EVEREST's preference for organizations whose compromise creates cascading breach-notification pressure, which increases ransom leverage.

Geographic Concentration

50% France, 25% US, 25% Spain. The FR/ES weighting suggests a Western European access batch — possibly credentials or vulnerable perimeter devices purchased from a single broker operating in francophone/Iberian markets — combined with one flagship US target.

Victim Profile

Company size ranges from mid-market French consultancies (~50–500 employees, €5M–€50M revenue) to large multinationals (Kingston ~$13B revenue; Capgemini Engineering parent group >€22B). EVEREST deliberately mixes whale targets with smaller victims to maintain negotiation optionality.

Posting Frequency / Escalation

4 postings in a single day is a burst pattern, not a steady drip. This typically indicates either: (a) a synchronized detonation wave from a shared initial access vector, or (b) a negotiation-deadline dump where multiple stalled talks expired simultaneously. Treat this as a campaign cluster, not four isolated incidents.

CVE Correlation

The CISA KEV entries confirmed in ransomware use map directly to EVEREST's known access playbook:

• CVE-2026-50751 (Check Point Security Gateway, improper authentication in IKEv1) — perimeter VPN exploitation, the group's preferred entry point. Any org running unpatched Check Point gateways should assume scanning activity.
• CVE-2024-1708 (ConnectWise ScreenConnect path traversal → RCE) — RMM abuse matches EVEREST's persistence/lateral movement tooling.
• CVE-2026-48027 (Nx Console embedded malicious code) — supply chain vector; notable given the technology-sector targeting.
• CVE-2025-60710 (Windows link following, privilege escalation) and CVE-2023-21529 (Exchange deserialization) — post-access privilege escalation and mailbox theft, consistent with data staging from email before exfil.

Assessment: This cluster likely chains a perimeter exploit (Check Point) → internal RMM or Exchange foothold → privilege escalation → bulk exfil → selective encryption.

3. Detection Engineering

---
title: EVEREST - Check Point VPN Anomalous Authentication Followed by Internal Session
id: 8f3a1c2e-ev01-4b1d-9a01-20260820aaa1
status: experimental
description: Detects successful VPN authentication from unusual ASN/geography followed within 30 minutes by RDP or SMB session to internal assets - pattern consistent with EVEREST perimeter access via CVE-2026-50751
author: Security Arsenal Threat Intel
references:
    - https://securityarsenal.com/darkside
date: 2026/08/20
logsource:
    category: firewall
    product: checkpoint
detection:
    selection_auth:
        action: accept
        service: VPN-1*
    selection_geo:
        src_country:
            - 'RU'
            - 'NL'
            - 'BG'
            - 'RO'
            - 'UNKNOWN'
    condition: selection_auth and selection_geo
falsepositives:
    - Legitimate roaming users on hosting-provider IPs
level: high
tags:
    - attack.initial_access
    - attack.t1133
    - attack.t1190
---
title: EVEREST - RMM Tool Execution Outside Approved Baseline
id: 8f3a1c2e-ev02-4c2e-8b02-20260820bbb2
status: experimental
description: Detects execution of ScreenConnect, AnyDesk, or other RMM binaries not present in the approved software baseline - EVEREST deploys RMM for persistence after CVE-2024-1708-style exploitation
author: Security Arsenal Threat Intel
date: 2026/08/20
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\screenconnect.clientservice.exe'
            - '\anydesk.exe'
            - '\splashtop.exe'
            - '\atera_agent.exe'
            - '\ninjarmm.exe'
    selection_user:
        User|contains:
            - 'SYSTEM'
            - 'ADMIN'
    filter_baseline:
        CommandLine|contains: 'C:\ProgramData\ApprovedRMM\'
    condition: selection_img and selection_user and not filter_baseline
falsepositives:
    - Helpdesk-deployed tooling during onboarding
level: critical
tags:
    - attack.command_and_control
    - attack.t1219
    - attack.persistence
---
title: EVEREST - Pre-Encryption Data Staging via Archive Utility
id: 8f3a1c2e-ev03-4d3f-8c03-20260820ccc3
status: experimental
description: Detects mass archive creation (7z/rar) targeting document shares followed by outbound transfer processes - EVEREST stages exfil 48-72h before detonation
author: Security Arsenal Threat Intel
date: 2026/08/20
logsource:
    category: process_creation
    product: windows
detection:
    selection_archive:
        Image|endswith:
            - '\7z.exe'
            - '\7za.exe'
            - '\rar.exe'
            - '\winrar.exe'
    selection_cmd:
        CommandLine|contains:
            - ' a '
            - '-p'
            - '*.doc'
            - '*.pdf'
            - '*.xls'
            - '\\*\*\'
    filter_exfil_tool:
        ParentImage|endswith:
            - '\rclone.exe'
            - '\megasync.exe'
            - '\filezilla.exe'
    condition: selection_archive and selection_cmd
falsepositives:
    - Backup jobs (exclude known service accounts)
level: high
tags:
    - attack.collection
    - attack.t1560.001
    - attack.exfiltration

// EVEREST Pre-Ransomware Hunt: Lateral Movement + Staging Indicators
// Microsoft Sentinel - run over 14 days, tune CriticalAssets watchlist
let lookback = 14d;
let rmm_procs = dynamic(["ScreenConnect.ClientService.exe","AnyDesk.exe","rclone.exe","MEGAsync.exe","FileZilla.exe"]);
let staging_procs = dynamic(["7z.exe","7za.exe","rar.exe","WinRAR.exe"]);
let psexec_wmi = dynamic(["PsExec.exe","PsExec64.exe","wmic.exe","wmiprvse.exe"]);
let suspicious =
    union isfuzzy=true
    (DeviceProcessEvents
        | where Timestamp > ago(lookback)
        | where FileName in~ (rmm_procs) or FileName in~ (staging_procs) or FileName in~ (psexec_wmi)
        | project Timestamp, DeviceName, FileName, ProcessCommandLine, AccountName, InitiatingProcessFileName),
    (DeviceNetworkEvents
        | where Timestamp > ago(lookback)
        | where RemotePort == 445 or RemotePort == 3389 or RemotePort == 5985
        | project Timestamp, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort);
// Correlate: same device showing BOTH staging tools AND lateral movement ports within 6h = high fidelity
suspicious
| summarize EventCount=count(), Tools=make_set(FileName), RemoteTargets=make_set(RemoteIP) by DeviceName, AccountName, bin(Timestamp, 6h)
| where array_length(Tools) >= 2
| project Timestamp, DeviceName, AccountName, EventCount, Tools, RemoteTargets
| order by Timestamp desc;

# EVEREST Rapid Triage: persistence + shadow copy tampering + exposed RDP
# Run elevated on suspected hosts. Output: C:\IR_Triage_<hostname>_<date>.txt
$out = "C:\IR_Triage_$($env:COMPUTERNAME)_$(Get-Date -Format 'yyyyMMdd').txt"
"=== EVEREST Rapid Triage - $(Get-Date) ===" | Out-File $out

"`n[1] Scheduled tasks created in last 7 days:`n" | Out-File $out -Append
Get-ScheduledTask | Where-Object { $_.Date -gt (Get-Date).AddDays(-7) } |
    Select-Object TaskName, TaskPath, Date, Author | Format-Table -Auto | Out-String | Out-File $out -Append

"`n[2] Volume Shadow Copy status (deletion = pre-encryption indicator):`n" | Out-File $out -Append
vssadmin list shadows 2>&1 | Out-File $out -Append
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7036} -MaxEvents 50 -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'Shadow Copy|VSS' } | Out-File $out -Append

"`n[3] RDP exposure & recent logons (Type 3/10 from non-internal IPs):`n" | Out-File $out -Append
(Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue) | Out-File $out -Append
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624} -MaxEvents 2000 -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'Logon Type:\s+(3|10)' } |
    Select-Object -First 30 TimeCreated, Message | Out-File $out -Append

"`n[4] Recent run-key & service persistence:`n" | Out-File $out -Append
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -ErrorAction SilentlyContinue | Out-File $out -Append
Get-CimInstance Win32_Service | Where-Object { $_.PathName -match 'Temp|AppData|ProgramData' -and $_.State -eq 'Running' } |
    Select-Object Name, PathName, StartName | Out-File $out -Append

"`n[5] Unauthorized RMM processes:`n" | Out-File $out -Append
Get-Process | Where-Object { $_.Name -match 'screenconnect|anydesk|rclone|megasync|atera|ninja|splashtop' } | Out-File $out -Append

Write-Host "Triage complete: $out"

4. Incident Response Priorities

T-Minus Detection Checklist (before encryption fires)

• New or re-enabled local admin accounts with non-standard naming (EVEREST often uses support, admin1, or mimics existing naming conventions)
• VSS deletion events (vssadmin delete shadows, Event ID 7036 service churn on VSS)
• Outbound transfers to MEGA, file.io, or rclone endpoints exceeding baseline by >3x
• RMM agent installations not tied to a change ticket
• Exchange New-MailboxExportRequest or unusual OWA/EWS access (post-CVE-2023-21529 exploitation)
• Kerberos anomalies: golden-ticket-style TGT lifetimes, DCSync-style replication requests (Event 4662 with replication GUIDs)

Exfiltration Priorities (what EVEREST takes first)

1. Client contracts and legal files — for professional services victims, this is the negotiation hammer (downstream notification liability)
2. Finance/AP data and banking details — enables follow-on fraud
3. Email archives of C-suite and legal counsel
4. IP/source code — primary target in the technology-sector intrusions
5. HR records — PII for regulatory pressure (GDPR relevance given FR/ES victims)

Containment (ordered by urgency)

1. Isolate, don't kill — segment affected hosts at the switch/EDR level before powering down; preserve memory for Cobalt Strike artifact recovery
2. Disable compromised VPN concentrators and force global credential reset including service accounts
3. Block exfil destinations at the egress proxy (MEGA, file.io, anonfiles, rclone remotes)
4. Revoke all active sessions/tokens for accounts showing Type 3/10 logons from anomalous IPs
5. Snapshot affected VMs before any remediation
6. Engage IR retainer and notify counsel — French and Spanish victims trigger GDPR 72-hour clock; US victims may trigger state breach statutes

5. Hardening Recommendations

Immediate (24 hours)

• Patch Check Point Security Gateways against CVE-2026-50751 and disable IKEv1 where operationally possible — this is the likely entry vector for this cluster
• Patch/upgrade ConnectWise ScreenConnect (CVE-2024-1708) and audit for rogue screenconnect instances
• Enforce MFA on all remote access (VPN, RDP gateway, OWA) — EVEREST's purchased credentials fail against enforced MFA
• Block 7z/rar/rclone/MEGAsync execution for non-admin users via AppLocker/WDAC
• Alert on vssadmin delete and any scheduled task created by SYSTEM outside of patch windows

Short-Term (2 weeks)

• Deploy EDR with credential-theft protection (LSASS protection enabled, Credential Guard) to blunt the privilege escalation chain (CVE-2025-60710 class)
• Segment backup infrastructure onto isolated networks with immutable/offline copies — EVEREST operators actively hunt and destroy VSS and backup catalogs
• Implement egress filtering with TLS inspection for known exfil destinations
• Roll out deception: honey credentials and canary file shares — EVEREST's staging behavior triggers these reliably
• Tabletop a double-extortion scenario: decision matrix for leak publication, legal notification thresholds (GDPR, state AG), and negotiation policy

Bottom line: EVEREST's 2026-08-20 posting burst is a coordinated campaign cluster leaning on perimeter VPN exploitation and RMM persistence. Organizations running Check Point gateways, ScreenConnect, or unpatched Exchange in the US, France, or Spain should treat this as an active threat and run the hunt queries above today.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub