Everest

422

victims

aliases

Intelligence Profile

Everest — tracked by MISP Galaxy (ransomware).

Threat Analysis

Everest is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

Ransomware Victims (422)

CTIWATCH tracks 422 organizations claimed as victims by Everest on its data leak site, with attack dates, sectors and countries.

View full victims list →

Intelligence Reports Mentioning Everest

Everest Forms Vulnerability Exploited to Hack WordPress Sites

SecurityWeek· Jun 8, 2026

Critical Everest Forms Pro flaw exploited to take over WordPress sites

BleepingComputer· Jun 6, 2026

Hackers Exploit Critical Everest Forms Pro WordPress Plugin Flaw to Take Over Sites

The Hacker News· Jun 5, 2026

Everest Forms Pro Vulnerability Allows Remote Code Execution on WordPress Sites

Infosecurity Magazine· Jun 4, 2026

US Healthcare Diagnostic Firm Says 140,000 Affected by Data Breach

SecurityWeek· Feb 23, 2026

External References

→https://www.reuters.com/article/us-usa-products-colonial-pipeline-ransom/more-ransomware-websites-disappear-in-aftermath-of-colonial-pipeline-hack-idUSKCN2CX0KT

→https://www.ransomlook.io/group/everest

→https://www.zscaler.com/blogs/security-research/everest-ransomware-extortion

→https://www.trellix.com/en-us/about/newsroom/stories/research/everest-ransomware-gang-offers-access-to-compromised-networks.html

→https://www.bleepingcomputer.com/news/security/everest-ransomware-now-selling-company-data-on-hacker-forums/

Quick Facts

TypeAPT / Threat Group

Aliases1

Also Known As

Everest

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Everest Victims (422)·Geopolitics Map·Search Everest