Executive Summary
Everest is a sophisticated, Windows-based ransomware operation active since December 2020. Operating as a closed group, it has evolved beyond traditional ransomware to include a triple revenue model: double-extortion attacks, initial access brokerage (IAB), and a unique corporate insider recruitment program established in late 2023. The group primarily targets Western organizations across sectors such as healthcare, finance, and aviation, with over one-third of its victims located in the United States.
Technically, Everest shares significant overlap with BlackByte, specifically in its use of local AES-128-CBC key generation rather than relying on live C2 connectivity. The group employs advanced defense evasion techniques, including the use of the ConfuserEx obfuscator, self-mutation of process security descriptors to prevent termination, and the systematic removal of security tools like Raccine. Their impact is high, as they combined data theft with encryption while maintaining a Tor-based leak site to pressure victims.