Classification: TLP:CLEAR | Publication Date: 2026-09-26 | Source: ransomware.live leak-site monitoring | Nature of data: Unverified threat-actor claims

EVEREST Ransomware Gang: 6 New Leak-Site Listings Posted — Sector Targeting Analysis & Detection Rules

Executive Summary

EVEREST has listed six organizations on its dark web leak site in postings observed on 2026-09-25: Securitas Group, Morula IVF, Reliance Audit, UNIRITA, CENELEC and ETS. These are criminal claims, not confirmed breaches. The claimed set concentrates in Professional Services, Healthcare, Technology and Education, with named countries including SE, ZA, JP and BE and two listings without a confirmed country in the source data. Defenders should treat this as a campaign signal: EVEREST is advertising access and alleged data theft across mid-market and enterprise-adjacent services organizations, where one compromised identity, exposed remote access service or unpatched edge platform can become a multi-victim extortion event. Priority actions are to hunt for pre-encryption staging, validate remote access logging, review virtualization and CI/CD exposure, and prepare legal/comms decision trees before any actor deadline expires.

Sourcing & Verification

• Corroboration in this dataset refers only to crawler observation: 6 of 6 listings were independently observed by a second leak-site crawler; 0 appear on a single source only.
• Inclusion reflects the threat actor's claim and is NOT confirmation of a breach, intrusion, data theft or operational impact.
• A named organization may dispute the listing, and a denial is likewise not proof the claim is false; disclosure obligations vary by jurisdiction and sector, and not every incident is reportable, so neither silence nor denial settles the question.
• Security Arsenal will publish corrections and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — EVEREST

• Known aliases: EVEREST ransomware group; historically tracked by some vendors as an extortion-focused operation with ransomware and data-leak activity. Treat vendor naming as fluid because underground branding, affiliates and infrastructure change quickly.
• Operating model: closed-leaning RaaS/extortion crew rather than a fully open affiliate marketplace. Access appears to be brokered or curated, with the core group controlling leak-site publication and negotiation pressure.
• Typical ransom demands: frequently aligned to perceived revenue, cyber-insurance posture and sensitivity of claimed data. For professional services and healthcare claims, pressure usually emphasizes client confidentiality, regulatory exposure and downstream contractual harm more than raw encryption downtime.
• Known initial access methods: phishing-led credential theft and malicious documents, exploitation or abuse of exposed VPN/remote access, weak or reused RDP credentials, purchased initial access, and opportunistic exploitation of internet-facing management planes. For this briefing, any CVE linkage is sector-level exposure, not victim-specific attribution.
• Double extortion: EVEREST publicly names organizations and threatens or publishes alleged stolen data to increase settlement pressure. Encryption is not required for damage; claimed exfiltration alone can trigger client notification, privilege review, regulator analysis and litigation hold decisions.
• Average dwell time before detonation: commonly days to a few weeks in comparable crews, but leak-site timing is not a reliable clock. The listing date can reflect negotiation failure, delayed proof-pack publication, affiliate handoff or opportunistic disclosure after quiet access.

Current Campaign Analysis

• Sectors being targeted from the victim data: Professional Services is most prominent with Securitas Group, Reliance Audit and CENELEC; Healthcare appears via Morula IVF; Technology via UNIRITA; Education via ETS.
• Geographic concentration: SE, ZA, JP and BE are named, while Reliance Audit and ETS are listed with unknown country in the source set. This is not a single-region operation; it resembles selective intrusion-to-extortion conversion across jurisdictions with different breach-notification clocks.
• Victim profile: claimed organizations span mid-market to enterprise-adjacent service providers and specialized institutions. Revenue estimates should be treated as directional only: professional services and standards/audit bodies often hold high-value client metadata at modest headcount; healthcare fertility providers hold sensitive identity and medical-adjacent records; technology firms can expose build systems and customer environments; education organizations hold identity data and broad third-party integrations.
• Observed posting frequency: six listings published 2026-09-25 within the last 100 postings captured by ransomware.live. A same-day cluster suggests an escalation window, batch publication after collection, or negotiation deadline synchronization rather than proof of simultaneous compromise.
• CVE connection as hypothesis only: CISA KEV lists CVE-2026-59310 VMware vCenter path traversal, CVE-2026-63077 JetBrains TeamCity deserialization, CVE-2026-20316 Cisco Secure FMC hard-coded password, CVE-2026-50751 Check Point improper authentication and CVE-2026-48027 Nx Console embedded malicious code. These are confirmed exploited at sector level and map to EVEREST-style interests in virtualization control, build pipelines, edge management and developer workstation trust. No evidence in this dataset ties any named listing to a specific CVE.

Detection Engineering

---
title: EVEREST-style remote access brute force followed by interactive logon
id: 7c1e0a21-everest-001
status: experimental
description: Detects repeated failed remote authentication followed by success on VPN, RDP or edge remote access where pre-ransomware operators commonly validate bought or phished credentials.
author: Security Arsenal
logsource:
  category: authentication
  product: windows
detection:
  selection_fail:
    EventID: 4625
    LogonType|contains:
      - '3'
      - '10'
  selection_success:
    EventID: 4624
    LogonType|contains:
      - '3'
      - '10'
  condition: selection_fail and selection_success
  timeframe: 30m
level: high
tags:
  - attack.initial_access
  - attack.t1078
  - attack.t1133
  - attack.t1110
falsepositives:
  - service accounts with stale cached credentials
  - VPN gateway health probes
fields:
  - Account_Name
  - Source_Network_Address
  - Workstation_Name
  - Logon_Type
date: 2026/09/26
---
title: EVEREST pre-encryption staging via archive creation and shadow copy tampering
id: 7c1e0a21-everest-002
status: experimental
description: Detects compression of sensitive directories, enumeration of backups and deletion or resize attempts against Volume Shadow Copies before detonation.
author: Security Arsenal
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\vssadmin.exe'
      - '\bcdedit.exe'
      - '\wbadmin.exe'
      - '\powershell.exe'
      - '\rar.exe'
      - '\7z.exe'
  selection_cli:
    CommandLine|contains:
      - 'delete shadows'
      - 'resize shadowstorage'
      - 'recoveryenabled no'
      - 'delete catalog'
      - ' a -r '
      - ' a -m '
      - 'Compress-Archive'
  condition: selection_img and selection_cli
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.t1560.001
  - attack.collection
falsepositives:
  - backup administrators testing restore workflows
  - endpoint protection cleanup scripts
fields:
  - Image
  - CommandLine
  - ParentImage
  - User
date: 2026/09/26
---
title: EVEREST lateral movement using PsExec service creation or WMI process spawn
id: 7c1e0a21-everest-003
status: experimental
description: Detects remote service creation and WMI-launched child processes consistent with hands-on-keyboard spread before exfiltration or encryption.
author: Security Arsenal
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\wmiprvse.exe'
      - '\psexec.exe'
      - '\psexesvc.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
  condition: selection_parent and selection_child
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1047
  - attack.t1569.002
falsepositives:
  - SCCM and legitimate software distribution
  - admin jump-host automation
fields:
  - ParentImage
  - Image
  - CommandLine
  - User
date: 2026/09/26

let lookback = 7d;
let staging_terms = dynamic(['delete shadows','resize shadowstorage','recoveryenabled no','delete catalog','Compress-Archive',' a -r ',' a -m ','rclone','megacmd','curl.exe -T','powershell -enc']);
let suspicious_proc =
DeviceProcessEvents
| where Timestamp >= ago(lookback)
| where ProcessCommandLine has_any (staging_terms)
   or InitiatingProcessFileName in~ ('wmiprvse.exe','psexec.exe','psexesvc.exe')
   or FileName in~ ('vssadmin.exe','bcdedit.exe','wbadmin.exe','rar.exe','7z.exe','rclone.exe')
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, FolderPath, RemoteDeviceName, RemoteIP;
let auth_pressure =
DeviceLogonEvents
| where Timestamp >= ago(lookback)
| summarize Failed=countif(ActionType == 'LogonFailed'), Success=countif(ActionType == 'LogonSuccess'), Sources=dcount(RemoteIP), Devices=dcount(DeviceName) by AccountName, bin(Timestamp, 30m)
| where Failed >= 10 and Success >= 1;
let rare_network =
DeviceNetworkEvents
| where Timestamp >= ago(lookback)
| where RemotePort in (445,3389,5985,5986) or RemoteUrl has_any ('mega.nz','transfer.sh','file.io','anonfiles')
| summarize BytesSentApprox=count(), RemoteIPs=make_set(RemoteIP), Ports=make_set(RemotePort) by DeviceName, InitiatingProcessFileName, bin(Timestamp, 1h);
suspicious_proc
| join kind=leftouter (auth_pressure) on AccountName
| join kind=leftouter (rare_network) on DeviceName
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, Failed, Success, RemoteIPs, Ports
| order by Timestamp desc;

$since = (Get-Date).AddDays(-7)
$results = [ordered]@{}
$results.RdpEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 0
$results.RdpNla = try { (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp').UserAuthentication } catch { 'unknown' }
$results.RecentScheduledTasks = Get-ScheduledTask | Where-Object {$_.Date -ge $since -and $_.TaskPath -notlike '\Microsoft*'} | Select-Object TaskName,TaskPath,Date,Author
$results.ShadowCopies = try { Get-CimInstance Win32_ShadowCopy | Select-Object ID,InstallDate,DeviceObject,VolumeName } catch { 'query failed' }
$results.NewLocalAdmins = Get-LocalGroupMember -Group 'Administrators' -ErrorAction SilentlyContinue | Select-Object Name,PrincipalSource
$results.SuspiciousRunKeys = Get-ItemProperty 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run','HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -ErrorAction SilentlyContinue
$results.PendingGpoOrScripts = Get-ChildItem 'C:\Windows\System32\GroupPolicy\Machine\Scripts','C:\Windows\System32\GroupPolicy\User\Scripts' -Recurse -ErrorAction SilentlyContinue | Where-Object {$_.LastWriteTime -ge $since} | Select-Object FullName,LastWriteTime
$results.ExposedManagers = Test-NetConnection -ComputerName localhost -Port 443 -InformationLevel Quiet
$results | ConvertTo-Json -Depth 5

Incident Response Priorities

• T-minus detection checklist before encryption fires: bursts of failed then successful remote logons; new local admin or service account; PsExec service install events; WMI process spawning across subnets; vssadmin, bcdedit or wbadmin execution; unexpected 7z/rar/Compress-Archive on file servers; rclone, MEGA, curl upload or large egress to rare destinations; TeamCity/vCenter/FMC/Check Point admin logons outside change windows; EDR tamper, defensive exclusions added, or log clearing.
• Critical assets historically prioritized for exfiltration by extortion crews: executive mailboxes, legal and HR repositories, finance and audit workpapers, client contracts, credential stores, build artifacts and signing keys, backup catalogs, virtualization inventories, healthcare identity records, student records and third-party data-sharing folders.
• Containment actions ordered by urgency: 1 isolate affected identity and revoke sessions/tokens; 2 block egress to uncommon storage and bulletproof hosting while preserving logs; 3 disable exposed remote access for suspect accounts and enforce MFA reset; 4 isolate file servers, hypervisor management, CI/CD and backup controllers from lateral SMB/WMI/RDP; 5 snapshot forensic evidence before shutdown; 6 rotate domain admin, service, API, VPN and build-system secrets; 7 verify backup immutability and restore path; 8 engage counsel for claim validation, privilege, notification analysis and leak-site monitoring.

Hardening Recommendations

• Immediate in 24 hours: enforce phishing-resistant MFA on VPN, RDP gateways, vCenter, Check Point, Cisco FMC and cloud identity; block inbound RDP/SMB from internet; disable IKEv1 where not required on Check Point; restrict TeamCity and Nx developer tooling to authenticated private networks; alert on vssadmin/bcdedit/wbadmin and archive tools on servers; enable tamper protection and ASR rules; turn on long-retention VPN and Windows authentication logs; pre-stage emergency credential rotation and legal hold templates.
• Short-term in two weeks: move management planes behind ZTNA with device posture; segment backup, virtualization, CI/CD and crown-jewel file shares into separate enclaves; implement immutable/offline backups with tested restore; deploy canary files and honey credentials; constrain PsExec/WMI via application control and just-in-time admin; require signed scripts and package provenance for developer tools; create an extortion playbook that treats data-theft claims as incidents even without encryption.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub