Everest ransomware

Everest is a closed, Russian-speaking extortion crew active since December 2020 that runs a Windows encryptor, sells network access and pays insiders for entry. When the encryptor is used, files gain the .everest extension and a text note whose name includes EVEREST LOCKER; a variant named EVERESTRANSOMWARE.txt is also reported. Many recent cases involve no encryption at all, and the victim learns of the attack only from a listing on the group's Tor leak site. Entry comes through RDP or VPN without multi-factor authentication, purchased or stuffed credentials, and access offered by recruited employees, followed by Cobalt Strike, remote-management tools and WinRAR archives to stage and steal data. Since 2021 the group has also resold network footholds to other criminals, and in 2025 and 2026 most of its activity has been data-theft claims against large brands, some judged overstated. Researchers link its code to BlackByte and its origins to the EverBe 2.0 family.

File extensions: .everest

Ransom note filenames: EVERESTRANSOMWARE.txt

Decryptor: Decryptor availability has not been recorded. Checked 2026-10-28.

Data exfiltration risk: Confirmed — Incident response work found data archived with WinRAR for theft, and many Everest cases are pure data-theft extortion announced on its leak site without any encryption.

Systems typically targeted: Windows servers and workstations

Do this first: Revoke all VPN and RDP accounts and remote-management tool enrollments that could have been sold or handed over by an insider, then review recent logins for unfamiliar devices.