EVERSTAKE Ransomware Gang: 5 New Listings Claimed — Sector Targeting Analysis, Hypothesized Exposure Paths & Detection Rules

Classification: TLP:CLEAR | Publication Date: 2026-10-31 | Source: ransomware.live leak-site monitoring | Nature of data: Unverified threat-actor claims

Executive Summary

Between 2026-10-29 and 2026-10-30, the EVERSTAKE ransomware group listed five organizations on its dark web leak site. All five listings were independently observed by a second leak-site crawler, which confirms that the gang published these claims — but it does not confirm that any breach occurred. EVERSTAKE claims to have compromised spg.com (published 2026-10-30), asg.com, cas.com, ins.com, and corp-smart.com (all published 2026-10-29). Of the five, only corp-smart.com carries a sector tag (Technology); the remaining four are tagged "Not Found," meaning the gang's own posting did not disclose a sector. Targeted countries are listed as "multiple."

Security teams at organizations matching these profiles — particularly mid-market technology firms — should treat these unverified claims as a trigger for proactive threat hunting against EVERSTAKE's known playbook: edge-device exploitation, credential-based access, and pre-encryption data staging.

Sourcing & Verification

• 5 of 5 listings in this briefing were independently observed by a second leak-site crawler (MULTI-SOURCE tier). 0 listings appear on a single source only. Multi-source observation confirms the gang made the claim; it does not confirm any intrusion.
• Inclusion in this briefing reflects the threat actor's claim and is not confirmation of a breach. No corroboration tier in our data confirms a breach — only the affected organization or its regulator can do that.
• A named organization may dispute a listing. A denial is likewise not proof that the claim is false: disclosure obligations vary by jurisdiction and not every incident is reportable, so neither silence nor denial settles the question.
• Security Arsenal will publish corrections as warranted and welcomes contact from any named organization at security@securityarsenal.com.

Threat Actor Profile — EVERSTAKE

EVERSTAKE operates as a ransomware operation observed maintaining its own .onion leak site for victim naming and data-leak pressure, consistent with a double-extortion model: files are encrypted and exfiltrated, with publication threats used as leverage.

• Aliases: None confirmed in current data. EVERSTAKE branding on its leak site is the primary identifier tracked by ransomware.live.
• Operating model: Not definitively established from current data. The small, curated posting cadence (5 listings in the last 100 postings) is more consistent with a closed or semi-closed group than a high-volume Ransomware-as-a-Service (RaaS) affiliate program, but this is an assessment, not a confirmed fact.
• Typical ransom demands: Not disclosed in current data. Demands from comparably sized operations typically scale to victim revenue; organizations should not treat any specific figure as authoritative.
• Initial access methods: Not directly evidenced for this campaign. Sector-relevant hypotheses — framed as hypothesis only — include exploitation of internet-facing infrastructure (VPN concentrators, firewalls, virtualization management planes), phishing with malicious macros or links, and exposed RDP.
• Dwell time: Not established for EVERSTAKE specifically. Across comparable double-extortion operations, median dwell time from initial access to detonation is frequently measured in days, with data staging occurring in the final 48–96 hours — the window defenders must exploit.

Current Campaign Analysis

Sectors Targeted

From the leak-site data: one listing tagged Technology (corp-smart.com) and four tagged Not Found (spg.com, asg.com, cas.com, ins.com). The "Not Found" tag means EVERSTAKE did not disclose a sector in those postings — it is not evidence of any particular vertical. We will not speculate on the identity of masked victim names.

Geographic Concentration

EVERSTAKE's posting metadata indicates multiple countries. No single-country concentration can be asserted from this dataset.

Victim Profile

With four of five sectors undisclosed and no revenue figures published by the gang, a reliable size/revenue profile cannot be constructed. The technology-sector tag on one listing suggests at least partial interest in firms holding valuable intellectual property or customer data — a profile consistent with extortion-driven targeting.

Posting Frequency / Escalation

All five current listings were published within a 48-hour window (2026-10-29 through 2026-10-30). A clustered publication pattern like this typically indicates either a batch of intrusions reaching the extortion stage simultaneously, or a deliberate publicity push. With only five listings in the last 100 postings on record, EVERSTAKE remains a low-volume operation by leak-site count — but low volume does not equal low severity for named organizations.

CVE Exposure — Hypothesis Only

We have no evidence linking any named listing to a specific vulnerability. The following CISA KEV entries represent sector-level exposure that ransomware operators broadly — including groups with EVERSTAKE's profile — are known to favor as initial access. Treat these as prioritized patch-and-hunt hypotheses, not attribution:

• CVE-2026-59310 (VMware vCenter path traversal, KEV 2026-08-18) — hypervisor management planes are prime ransomware targets; compromise here enables mass encryption of virtualized estates.
• CVE-2026-50751 (Check Point Security Gateway improper authentication, KEV 2026-06-08) — edge VPN/firewall appliances are the most common ransomware initial-access vector class.
• CVE-2026-20316 (Cisco Secure FMC hard-coded password, KEV 2026-07-29) — network security management compromise yields credential access and policy visibility.
• CVE-2026-63077 (JetBrains TeamCity deserialization, KEV 2026-08-05) — CI/CD servers are high-value for supply-chain-adjacent access, especially relevant to the technology-sector listing.
• CVE-2026-48027 (Nx Console embedded malicious code, KEV 2026-05-27) — developer-tooling compromise is a supply chain exposure path relevant to technology firms.

If your organization runs any of these products unpatched, your exposure exists regardless of EVERSTAKE's claims.

Detection Engineering

The following detections target the TTP cluster consistent with double-extortion ransomware operations of EVERSTAKE's profile: edge/VPN initial access, credential dumping, PsExec/WMI lateral movement, and pre-encryption data staging.

---
title: Suspicious Authentication Anomalies on VPN and Edge Appliances
id: 7f3a1c2e-9b4d-4e5a-8c1f-2d6e7a8b9c01
status: experimental
description: Detects authentication patterns consistent with edge-device compromise and credential-based initial access used by ransomware operators - logins from unusual geographies or ASNs, brute-force bursts followed by success, and off-hours admin VPN access.
author: Security Arsenal Threat Intelligence
date: 2026/10/31
references:
    - https://securityarsenal.com/darkside
logsource:
    category: authentication
    product: vpn
detection:
    selection_failed_burst:
        Authentication_Status: 'failure'
    filter_success:
        Authentication_Status: 'success'
    condition: selection_failed_burst | filter_success
    timeframe: 10m
level: medium
tags:
    - attack.initial_access
    - attack.t1133
    - attack.t1110
falsepositives:
    - Legitimate remote workers traveling
    - Scheduled vulnerability scanners
---
title: PsExec or WMI Remote Service Creation for Lateral Movement
id: 8a4b2d3f-0c5e-5f6b-9d2a-3e7f8b9c0d12
status: experimental
description: Detects remote service creation and ADMIN$ share writes consistent with PsExec-style lateral movement and WMI process execution commonly used in pre-encryption ransomware staging.
author: Security Arsenal Threat Intelligence
date: 2026/10/31
references:
    - https://securityarsenal.com/darkside
logsource:
    category: process_creation
    product: windows
detection:
    selection_psexec:
        EventID: 7045
        Service_File_Name|contains:
            - '\\ADMIN$\\'
            - 'PSEXESVC'
            - '\\C$\\Windows\\'
    selection_wmi:
        Image|endswith: '\\WmiPrvSE.exe'
        CommandLine|contains:
            - 'powershell'
            - 'cmd.exe'
            - 'rundll32'
    condition: 1 of selection_*
level: high
tags:
    - attack.lateral_movement
    - attack.t1021.002
    - attack.t1047
    - attack.t1569.002
falsepositives:
    - Enterprise software deployment tools (SCCM, PDQ)
    - IT administration during maintenance windows
---
title: Pre-Ransomware Data Staging and Shadow Copy Tampering
id: 9b5c3e4a-1d6f-6a7c-0e3b-4f8a9c0d1e23
status: experimental
description: Detects the final pre-encryption phase - mass archive creation to staging directories, execution of common exfiltration tools, and Volume Shadow Copy deletion used to inhibit recovery.
author: Security Arsenal Threat Intelligence
date: 2026/10/31
references:
    - https://securityarsenal.com/darkside
logsource:
    category: process_creation
    product: windows
detection:
    selection_shadow:
        Image|endswith:
            - '\\vssadmin.exe'
            - '\\wmic.exe'
            - '\\bcdedit.exe'
        CommandLine|contains:
            - 'delete shadows'
            - 'shadowcopy delete'
            - 'recoveryenabled no'
    selection_exfil_tools:
        Image|endswith:
            - '\\rclone.exe'
            - '\\megasync.exe'
            - '\\winscp.exe'
            - '\\filezilla.exe'
    selection_archive:
        Image|endswith:
            - '\\rar.exe'
            - '\\7z.exe'
            - '\\winrar.exe'
        CommandLine|contains:
            - ' a '
            - '-p'
    condition: 1 of selection_*
level: critical
tags:
    - attack.impact
    - attack.t1490
    - attack.t1560.001
    - attack.t1567.002
falsepositives:
    - Legitimate backup administrators managing shadow copies
    - Developers using archiving tools

// Hunt: Pre-ransomware lateral movement and staging indicators (EVERSTAKE-consistent toolset)
// Lookback: 7 days. Pivot on hosts showing 2+ indicator classes within 24h.
let Lookback = 7d;
let SuspiciousStaging =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where ProcessCommandLine has_any ("delete shadows", "shadowcopy delete", "recoveryenabled no")
       or FileName in~ ("rclone.exe", "megasync.exe", "psexesvc.exe", "psexec.exe")
       or (FileName in~ ("rar.exe", "7z.exe") and ProcessCommandLine has " -p")
    | summarize StagingEvents = count(),
                Indicators = make_set(ProcessCommandLine, 20),
                FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
           by DeviceName, InitiatingProcessAccountName;
let LateralAuth =
    DeviceLogonEvents
    | where TimeGenerated > ago(Lookback)
    | where LogonType in ("Network", "RemoteInteractive")
    | where RemoteIP !startswith "10." and RemoteIP !startswith "192.168." and RemoteIP != "-"
    | summarize RemoteLogons = count(), SourceIPs = make_set(RemoteIP, 10)
           by DeviceName, AccountName;
SuspiciousStaging
| join kind=inner (LateralAuth) on $left.DeviceName == $right.DeviceName
| project DeviceName, StagingEvents, RemoteLogons, SourceIPs, FirstSeen, LastSeen, Indicators
| order by StagingEvents desc;

# Rapid pre-ransomware posture check - run elevated on critical servers and domain controllers
# Checks: recent scheduled tasks (7d), shadow copy tampering, suspicious staging tools, RDP exposure
param([int]$Days = 7)
$since = (Get-Date).AddDays(-$Days)

Write-Host "=== [1/4] Scheduled tasks created in last $Days days ===" -ForegroundColor Cyan
Get-ScheduledTask | ForEach-Object {
    $info = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
    [PSCustomObject]@{ TaskName = $_.TaskName; Path = $_.TaskPath; Author = $_.Author
        LastRun = $info.LastRunTime }
} | Where-Object { $_.Author -notmatch 'Microsoft' } | Format-Table -AutoSize

Write-Host "=== [2/4] Volume Shadow Copies (should exist on servers) ===" -ForegroundColor Cyan
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) { Write-Warning "NO shadow copies found - investigate vssadmin/bcdedit tampering immediately" }
else { $shadows | Select-Object DeviceObject, InstallDate, VolumeName | Format-Table -AutoSize }

Write-Host "=== [3/4] Staging/exfil tool binaries on disk ===" -ForegroundColor Cyan
$tools = 'rclone.exe','megasync.exe','psexesvc.exe','winscp.exe','filezilla.exe'
foreach ($drive in (Get-PSDrive -PSProvider FileSystem).Root) {
    Get-ChildItem -Path $drive -Recurse -Include $tools -ErrorAction SilentlyContinue -Depth 4 |
        Select-Object FullName, CreationTime, LastWriteTime
}

Write-Host "=== [4/4] RDP exposure check ===" -ForegroundColor Cyan
$rdpEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 0
$nla = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -ErrorAction SilentlyContinue).UserAuthentication
[PSCustomObject]@{ RDP_Enabled = $rdpEnabled; NLA_Enforced = ($nla -eq 1)
    Recommendation = if ($rdpEnabled -and $nla -ne 1) { 'CRITICAL: Enable NLA or disable RDP from internet' } else { 'Review' } } | Format-List

Incident Response Priorities

T-Minus Detection Checklist (Before Encryption Fires)

1. Authentication anomalies on VPN/edge appliances: brute-force bursts followed by success, logins from impossible geographies, off-hours admin sessions.
2. New local/domain accounts or unexpected group membership changes, especially on servers.
3. PsExec-style service creation (Event ID 7045) and ADMIN$ share writes on multiple hosts from a single source.
4. Mass archive creation — rar/7z processes with password flags (-p) touching file servers.
5. Shadow copy deletion commands (vssadmin delete shadows, bcdedit ... recoveryenabled no) — this is typically the last action before detonation. Alert at CRITICAL.
6. Unexpected outbound transfers to cloud storage or unfamiliar IPs from servers.

Assets This Profile of Gang Historically Prioritizes for Exfiltration

• File servers containing contracts, financials, and HR data (maximum extortion leverage)
• Backups and backup management consoles (to destroy recovery options)
• Domain controllers (credential theft for persistence and leverage)
• For technology firms: source code repositories and CI/CD infrastructure
• Executive and legal mailboxes

Containment Actions — Ordered by Urgency

1. Isolate affected hosts from the network (switch quarantine/EDR network isolation) — do not power off; preserve memory for forensics.
2. Disable compromised accounts and force enterprise-wide credential resets, prioritizing domain admins and service accounts.
3. Block egress to identified exfiltration destinations at the proxy/firewall.
4. Snapshot and preserve evidence: memory captures, VPN/auth logs (which rotate fast), EDR telemetry.
5. Segment backups offline and verify restorability before declaring recovery posture.
6. Engage IR counsel and assess disclosure obligations — even when a claim is unverified, materiality analysis obligations may be triggered by your own telemetry.

Hardening Recommendations

Immediate (24 Hours)

• Patch or mitigate the KEV-listed edge products if present in your environment: Check Point Security Gateway (CVE-2026-50751), Cisco Secure FMC (CVE-2026-20316), VMware vCenter (CVE-2026-59310), JetBrains TeamCity (CVE-2026-63077), and audit developer endpoints for the malicious Nx Console version (CVE-2026-48027). These are confirmed ransomware-exploited vulnerabilities.
• Enforce phishing-resistant MFA on all remote access (VPN, RDP gateways, VDI) and admin portals.
• Disable or restrict RDP from the internet; require NLA and gateway-brokered access only.
• Deploy the Sigma rules above and run the PowerShell posture check on domain controllers and file servers.
• Enable tamper protection on EDR and block vssadmin/bcdedit shadow deletion for non-backup-admin accounts.

Short-Term (Two Weeks)

• Segment the network so that workstation-to-server and server-to-server SMB/RPC is brokered and logged; ransomware lateral movement depends on flat reachability.
• Implement immutable/offline backups with a tested restore runbook; verify backup admin credentials are vaulted and separate from domain credentials.
• Deploy canary files and honey credentials on file servers to provide early, high-fidelity detonation warnings.
• Restrict CI/CD and developer tooling (TeamCity, Nx and similar) to authenticated build networks; technology firms should assume developer endpoints are initial-access targets.
• Establish an egress filtering baseline so that bulk transfers to consumer cloud storage alert by default.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub