Ransomware Group intelligence
Everest
ActiveTrack Everest with 434 published victims and 2 known leak locations in a single intelligence view.
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Everest is tracked by Breach House as a ransomware group with 434 published victims.
United States is currently the most targeted country in this dataset.
2 known leak locations are currently associated with this group.
Leak Status Distribution
97
- Leaked 81 83.5%
- Pending 14 14.4%
- Deleted 2 2.1%
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (2)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 1 | Onion service | Up checked 2h ago | ransomocmou6mnbquqz44ewosbkjk3o5qjsl3orawojexfook2j7esad.onion |
| Leak location 2 | Onion service | Up checked 2h ago | everestndkvzcibcje2cqxhre2hmmybl3rn2gwzwsblz7gx6uryn5rad.onion |
Top Activity Sectors (16)
- Not identified 108
- Finance / Legal / Insurance 51
- Healthcare / Pharma 46
- Communication / Marketing 43
- Services 37
- IT 27
- Manufacturing / Engineering 16
- Transportation / Travel / Logistics 15
- Energy 14
- Construction / Real Estate 10
- Retail / E-commerce 7
- Public Sector 7
- Agriculture / Food 6
- Hospitality / Food & Beverage / Tourism 6
- Telecommunications 5
- Education 1
Typical Attacks (10)
▼MITRE ATT&CK does not currently catalogue Everest, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: everest uses PowerShell scripts to execute malicious commands and deploy ransomware payloads across compromised systems.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
What they do: everest modifies Windows Registry Run Keys to ensure ransomware execution persists across reboots on compromised hosts.
What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: everest disables or modifies security tools like antivirus software to evade detection during initial compromise and execution phases.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1070.004 File Deletion Stealth
What they do: everest deletes Volume Shadow Copies and backup directories via system commands to prevent data recovery without payment.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1003.001 LSASS Memory Credential Access
What they do: everest accesses LSASS memory using credential-stealing tools to harvest user credentials for lateral access and evasion.
What that means: Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).
-
T1135 Network Share Discovery Discovery
What they do: everest performs network share discovery to identify accessible remote directories for lateral movement and victim data targeting.
What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: everest exploits SMB/Windows Admin Shares for lateral movement between networked systems within victim environments.
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1486 Data Encrypted for Impact Impact
What they do: everest encrypts victim files using custom ransomware binaries to maximize impact and force ransom payments.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1489 Service Stop Impact
What they do: everest executes Service Stop commands to terminate critical services, disrupting operational continuity during ransomware deployment.
What that means: Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.
-
T1490 Inhibit System Recovery Impact
What they do: everest invokes system recovery inhibition commands to prevent backup restoration and isolate compromised machines.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
Tools Observed (8)
▼Software Everest has been seen using, grouped by what it is used for. Legitimate administration tools appear here because these actors routinely abuse them — presence in this list is not itself malicious.
Credential theft
ProcDump
Discovery & enumeration
SoftPerfect NetScan
Offensive security tooling
Cobalt Strike
Metasploit
Meterpreter
Remote monitoring & management
AnyDesk
Atera
Splashtop
Tool data from Ransomware Tool Matrix by BushidoUK, licensed CC BY 4.0. Grouped by purpose and matched to this group by Breach House.
Ransom Notes (1)
▼The note this group leaves on a compromised machine. Click a filename to read it.
EVERESTRANSOMWARE.txt
Dear [snip], Greetings from the Everest team. Your systems have been attacked, the files are encrypted. You can read about us in our blog (Tor browser needed) Blog : ransomocmou6mnbquqz44ewosbkjk3o5qjsl3orawojexfook2j7esad.onion Or read about our group in Twitter Also, our team was able to bypass your "Dataprotection" as any other your protection software and more than 1 Terabyte of internal files were exfiltrated to our servers, which we can confirm with great joy and ease The list contains financial documents, internal orders, KYC information(documents,photos...), trusted representatives personal info Client risk levels,loans, debt and client data. Various financial documentation, backups , etc. etc. The information was collected both from personal PCs and from centralized storage locations. If an agreement is reached with us, this information will never be published and the problem will disappear as if it never happened, otherwise it will be posted on our blog and darknet. Which will lead to even greater financial and reputational losses on your part. Also you will get 1.Attack logbook (months of experience with your company) with full list of vulnerabilities and bypass methods 2.Advices how to singifically improve your security and avoid such attacks in the future 3.We will delete all files from your company 4.We will attack your company no more Yours trully Everest Team Email to contact: [email protected] Your key: [snip]
Ransom-note text from RansomLook, licensed CC BY 4.0.
Victims (434)
Search, filter and paginate the victim timeline for Everest. Showing 101–200 of 434.
| Type | Target | Discovered | Country | Business Category | Intel Link | Leak status |
|---|---|---|---|---|---|---|
| Ransomware | Atlas Air id26268 View details | United States | Transportation / Travel / Logistics | — | ||
|
[AI generated] Atlas Air Worldwide Holdings Inc. is a cargo and passenger charter airline based in Purchase, NY. Founded in 1992, Atlas Air operates globally with a large and efficient fleet of Boeing 747 aircraft. The company offers a variety of services like outsourced aircraft, crew maintenance, and insurance (ACMI), charter businesses, and dry leasing. |
||||||
| Ransomware | Polycom id26058 View details | United States | Communication / Marketing | pending | ||
|
[AI generated] Polycom is an American multinational company specializing in creating technology that fosters easy and efficient collaboration for businesses. Polycom's products include communication devices, video conferencing systems, and other related applications and services. The company has a globally spread presence, with its headquarters located in San Jose, California. It was acquired by Plantronics in July 2018. |
||||||
| Ransomware | Iron Mountain id26057 View details | United States | Services | — | ||
|
[AI generated] Iron Mountain Incorporated is a global business specializing in storage and information management services. Founded in 1951, based in Boston, Massachusetts, it helps organizations to store, manage, protect, retrieve information and data. Its offerings include records and information management, data backup and recovery, secure shredding, and data centers. |
||||||
| Ransomware | Shinwa Co Ltd id26055 View details | Japan | Construction / Real Estate | pending | ||
|
[AI generated] "Shinwa Co Ltd" is a Japan-based company primarily engaged in the civil engineering and construction business. The company's operations include disaster recovery work, civil engineering, and building construction. Its construction business involves the building of private homes, condominiums, and commercial facilities. Shinwa also partakes in real estate buying, selling, and rental activities. They are headquartered in Osaka, Japan. |
||||||
| Ransomware | Hosowaka Micron Group id26054 View details | Japan | Manufacturing / Engineering | — | ||
|
[AI generated] Hosokawa Micron Group is a global industrial process machinery manufacturer, providing turn-key solutions for powder processing, particle separation, mixing, drying, containment, compacting and more. Its offerings are used in the chemicals, cosmetics, food, mineral, pharmaceutical and plastics industries. Founded in Osaka, Japan, it operates worldwide with a strong presence in Europe and the Americas. |
||||||
| Ransomware | Stellium id26051 View details | United Kingdom | IT | leaked | ||
|
[AI generated] Stellium is a consulting firm focused on services for supply chain management optimization, such as data analytics, lean manufacturing strategies, and innovative technology implementation. They cater to multiple industries, including energy, manufacturing, technology, and healthcare, among others. Their methods revolve around the utilization of advanced data to optimize operations and produce successful business outcomes. |
||||||
| Ransomware | Acu Trans Solutions LLC id26050 View details | United States | Services | — | ||
|
[AI generated] Acu Trans Solutions LLC is a company providing professional translation services across multiple languages. It specializes in sectors such as legal, healthcare, business and government. Their team is made up of certified linguists and translators who deliver accurate and high-quality translations. Besides translation, services also include transcription and interpretation, aiding businesses in their international communication. |
||||||
| Ransomware | SIGMA Processing Group id26049 View details | Germany | Communication / Marketing | — | ||
|
[AI generated] N/A |
||||||
| Ransomware | Bolttech id25678 View details | Singapore | IT | — | ||
|
[AI generated] Bolttech is a technology-led, global insurtech company that aims to transform the way insurance is bought and sold. The company offers digital insurance products and services, as well as device protection and insurance distribution solutions. It is active in three sectors: Device Protection, Insurtech, and Digital Brokerage, serving millions of customers across Asia, North America and Europe. |
||||||
| Ransomware | Ciena id25631 View details | United States | Telecommunications | — | ||
|
[AI generated] Ciena Corporation is a US-based global supplier of telecommunications networking equipment, software, and services. The company's solutions support the delivery of voice, video, and data traffic for many of the world's largest telecom service providers. Its product portfolio includes solutions for optical transport, broadband access, data center connectivity, and software automation. It was founded in 1992 and headquartered in Hanover, Maryland. |
||||||
| Ransomware | Virginia Records - Database leaked id25619 View details | Bulgaria | Other | — | ||
|
[AI generated] N/A |
||||||
| Ransomware | McDonalds India id25618 View details | India | Hospitality / Food & Beverage / Tourism | deleted | ||
|
[AI generated] McDonald’s India, a subsidiary of the global fast-food giant, McDonald's Corporation, operates in India through two business entities, Connaught Plaza Restaurants Pvt. Ltd for North & East India and Hardcastle Restaurants Pvt. Ltd for West & South India. The company has revolutionized the fast-food industry in India since its establishment in 1996 with its menu of burgers, fries, drinks, and localized food items. With their extensive reach, they've significantly influenced India's quick-service restaurant segment. |
||||||
| Ransomware | Warning about the negotiator: All4you id25617 View details | Other | — | |||
|
[AI generated] N/A |
||||||
| Ransomware | GC Accounting id25604 View details | United Kingdom | Finance / Legal / Insurance | leaked | ||
|
[AI generated] N/A |
||||||
| Ransomware | WANCHI STEEL INDUSTRIAL id25603 View details | Taiwan, Province of China | Manufacturing / Engineering | leaked | ||
|
[AI generated] WANCHI STEEL INDUSTRIAL Co. Ltd. is a multinational company that specializes in steel manufacturing and distribution. The company has advanced production technology and equipment. They manufacture a variety of products including cold-rolled, hot-rolled, galvanized, and pre-painted galvanized steel. Their products are used widely in construction, automotive, appliance, and other industries. WANCHI STEEL INDUSTRIAL is known for its quality and commitment to innovation and sustainability. |
||||||
| Ransomware | Reeves Information Technology id25602 View details | United States | IT | leaked | ||
|
[AI generated] N/A |
||||||
| Ransomware | ASRock Rack id25601 View details | Taiwan, Province of China | Communication / Marketing | — | ||
|
[AI generated] ASRock Rack is a professional server and workstation manufacturer, dealing primarily with cutting-edge technology for data centers and cloud services. Established in 2013, this industry leader provides equipment specifically tailored for HPC, data center, enterprise IT, education, and small-medium businesses. Product range includes server motherboards, server and workstation systems, network appliances, and storage devices. |
||||||
| Ransomware | GIBSIN Engineers id25600 View details | India | Other | — | ||
|
[AI generated] N/A |
||||||
| Ransomware | Notin - Database leaked id25528 View details | Spain | Other | — | ||
|
[AI generated] N/A |
||||||
| Ransomware | National Money Mart Company - Database leaked id25527 View details | Canada | Communication / Marketing | — | ||
|
[AI generated] National Money Mart Company is a financial service provider that offers services like check cashing, payday loans, and money transfers. In a significant event, a database containing sensitive information of its clients was reportedly leaked, raising serious concerns about client data security and privacy. |
||||||
| Ransomware | IDeaS.com - Database leaked id25469 View details | IT | leaked | |||
|
[AI generated] IDeaS.com is a technology company that specializes in data-driven solutions like revenue management and business profit optimization. Their advanced analytics and robust algorithms help their clients in the hospitality and travel industries to make strategic revenue decisions. In the past, IDeaS.com suffered from a database leak, exposing sensitive information, emphasizing the importance of cybersecurity. |
||||||
| Ransomware | Morgan Records Management - Database leaked id25468 View details | United States | Services | leaked | ||
|
[AI generated] Morgan Records Management, based in Cleveland, Ohio, specializes in professional record and information management services, providing secure document storage, retrieval, destruction, and data backup. In the incident titled "Database Leaked", it appears the company was involved in a data breach exposing sensitive customer data. Specific details about this incident are not provided in this context. |
||||||
| Ransomware | Virginia Records id25406 View details | Bulgaria | Communication / Marketing | — | ||
|
[AI generated] Virginia Records is a Bulgarian record company and producer of music in a variety of genres, from pop and rock to jazz and folk. Founded in the mid-90s, it’s one of the oldest private music companies in Bulgaria. The company has a strong focus on discovering and developing new artists and has achieved fame and success with a number of Bulgarian musicians. |
||||||
| Ransomware | Nissan Motor Corporation id25405 View details | Japan | Communication / Marketing | — | ||
|
[AI generated] Nissan Motor Corporation is a multinational automobile manufacturer headquartered in Yokohama, Japan. The company, founded in 1933, produces a comprehensive range of vehicles, from luxury cars to commercial trucks. Nissan is known for its innovation in electric and autonomous driving technology. It includes brands like Infiniti and Datsun. It also has partnerships with Renault and Mitsubishi. |
||||||
| Ransomware | Morgan Records Management id25348 View details | United States | Services | — | ||
|
[AI generated] Morgan Records Management is a company specializing in secure document storage, data protection, and document destruction services. They offer solutions for digital transitions, including scanning services, and electronic content management systems. Their focus is on protecting client information, helping businesses save space, reduce risk, and manage data more efficiently. They operate both domestically and internationally. |
||||||
| Ransomware | DESY id25288 View details | Germany | Public Sector | leaked | ||
|
[AI generated] DESY, short for Deutsches Elektronen-Synchrotron, is a German research center funded by the Federal Republic of Germany, the states of Germany, and the German Research Foundation. Established in 1959 and based in Hamburg, it operates particle accelerators that are used to investigate the structure and function of matter. The center undertakes research in the fields of physics, photon science, nanotechnology, and much more. |
||||||
| Ransomware | Bolttech.io id25287 View details | Hong Kong | IT | leaked | ||
|
[AI generated] Bolttech.io is an insurtech company that drives digital transformation in the insurance and protection industry. They provide insurance technology solutions including device protection, insurtech as a service, and digital brokerage services. The company aims to improve customer experiences, offer innovative products and services, and drive growth across Asia, Europe, and North America. |
||||||
| Ransomware | IDeaS.com id25286 View details | United States | Services | — | ||
|
[AI generated] IDeaS is a global technology company specializing in revenue management solutions. They provide innovative software and services for profit optimization, forecasting and pricing to businesses like hotels, parking facilities, and rental agencies. Using advanced analytics, they help clients make data-driven decisions to increase revenue, control costs, and optimize business operations. |
||||||
| Ransomware | Chrysler - Database leaked id25284 View details | United States | Communication / Marketing | — | ||
|
[AI generated] Chrysler is a prominent American automobile manufacturer, known for several famous brands like Jeep and Dodge. In the past, it suffered a database leak incident, where confidential information related to customers, employees, or other important company data might have been exposed, leading to potential security and privacy issues. This often results from hacking, inadequate security measures, or other forms of data breach. |
||||||
| Ransomware | Chrysler id25088 View details | United States | Manufacturing / Engineering | leaked | ||
|
[AI generated] Chrysler is an American automobile manufacturer that was first established in 1925. Known for their range of reliable family cars, luxury sedans, and sporty convertibles, the company has a significant role in the global automotive industry. It was founded by Walter Chrysler, and is currently a subsidiary of Stellantis, resulting from the merger of Fiat Chrysler and Groupe PSA. |
||||||
| Ransomware | Notin id25033 View details | Spain | Communication / Marketing | leaked | ||
|
Proveedor tecnológico integral líder para notarías en España. Ofrecemos software de gestión (ERP), hardware, mantenimiento, ciberseguridad e Inteligencia Artificial. |
||||||
| Ransomware | Accela id25032 View details | United States | Communication / Marketing | — | — | |
|
[AI generated] Accela is a leading provider of cloud-based productivity and civic engagement applications for government agencies. Their solutions, including permitting, licensing, code enforcement, and public health solutions, are designed to streamline workflow, automate processes, and provide citizen access to various government services. Accela's software platform powers over 2000 governments worldwide. |
||||||
| Ransomware | ELC Electroconsult SpA id24841 View details | Italy | IT | leaked | ||
|
[AI generated] ELC Electroconsult SpA is an Italy-based engineering firm operating globally. It specializes in developing large infrastructure and engineering projects, including design and consultancy for hydroelectric power, renewable energy, and dams. Over years, it has gained extensive project development experience in various environments, combining technological innovation with sustainable development. |
||||||
| Ransomware | Sarmap - Database leaked id24626 View details | Switzerland | Communication / Marketing | leaked | ||
|
[AI generated] "Sarmap" appears to be a Swiss company that develops software for processing satellite and airborne imagery for use in fields like precision agriculture, environment, and defense. The phrase "Database leaked" is likely referring to an incident where confidential data managed by Sarmap was inadvertently released or stolen, potentially compromising the privacy of users or clients. |
||||||
| Ransomware | Benchmark Electronics Inc id24488 View details | United States | Services | — | ||
|
[AI generated] Benchmark Electronics Inc. is a global provider of integrated technology solutions and manufacturing services. Located in Arizona, USA, the company offers its services in various sectors including medical, industrial, aerospace, and defense. They specialize in electronic manufacturing services (EMS) and product design, engineering, technology solutions, advanced manufacturing, and after-market services. |
||||||
| Ransomware | Sarmap id24389 View details | Switzerland | Agriculture / Food | leaked | ||
|
[AI generated] Sarmap is a Swiss technological company that specializes in the field of Earth Observation. Established in 1998, the company develops software tools and provides applications mainly to the remote sensing community. Their specialization lies in radar and radar satellite data processing and distribution, for agriculture, environment, and disaster monitoring. |
||||||
| Ransomware | Petra id24388 View details | United States | Retail / E-commerce | — | ||
|
[AI generated] Petra is a multinational corporation that specializes in the manufacturing and distribution of consumer electronics and small appliances. They are based in Edmond, Oklahoma. This company works as a bridge between the manufacturers and retailers, providing thousands of high-quality products to retail stores nationwide. Petra Industries offers a variety of services from warehousing and distribution to logistics and supply chain solutions. |
||||||
| Ransomware | ASUS id24376 View details | Taiwan, Province of China | IT | leaked | ||
|
[AI generated] ASUS is a Taiwan-based multinational computer hardware and electronics company. Established in 1989, it is well-regarded for producing a wide variety of technology products such as personal computers, laptops, mobile phones, servers, Wi-Fi routers, graphics cards, and monitory. In addition, ASUS is the world's 5th largest PC vendor by unit sales. Recognized for its innovative and high-quality products, ASUS has won various international awards. |
||||||
| Ransomware | Exegy id24375 View details | United States | Services | — | ||
|
[AI generated] Exegy, Inc. is a technology firm providing managed services and real-time market data solutions. The company delivers hardware-accelerated appliances, cloud-based services, and historical market data for applications in trading, risk management, and market surveillance. Exegy serves firms globally in the financial services sector, including traders, market makers, and brokers. |
||||||
| Ransomware | National Money Mart Company id24218 View details | Canada | Finance / Legal / Insurance | — | ||
|
[AI generated] National Money Mart Company, commonly known as Money Mart, is a Canadian financial services company which provides payday loans, cheque cashing, tax preparation and money transfer services for underbanked or not-fully-served customers. Headquartered in Victoria, British Columbia, Money Mart operates in multiple locations across Canada. It has facilitated financial solutions for millions of customers since its inception in 1982. |
||||||
| Ransomware | Iberia Airlines id24212 View details | Spain | Transportation / Travel / Logistics | — | ||
|
[AI generated] Iberia Airlines, officially known as Iberia Líneas Aéreas de España S.A. Operadora, is the largest and national flag carrier airline of Spain. It was founded in June 1927 and operates an international network of services from its main base in Madrid. Iberia is a part of the International Airlines Group (IAG), along with other airlines like British Airways and Aer Lingus. Its fleet includes various Airbus models. |
||||||
| Ransomware | Iberia id24208 View details | Spain | Transportation / Travel / Logistics | leaked | ||
|
[AI generated] Iberia, officially known as Iberia Líneas Aéreas de España and owned by International Airlines Group, is the flag carrier airline of Spain. The company was founded in 1927 and its headquarters are located in Madrid, Spain. It operates an international network of services from its main base of Madrid-Barajas Airport. Iberia is a member of the Oneworld airline alliance. |
||||||
| Ransomware | Air Miles España, S.A id24186 View details | Spain | Other | leaked | ||
|
[AI generated] N/A |
||||||
| Ransomware | Petrobras Campos Basin 3D & 4D Seismic Survey Data id23952 View details | Brazil | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | Petrobras / SAExploration id23946 View details | Brazil | Energy | pending | ||
|
[AI generated] Petrobras is a state-owned Brazilian multinational corporation involved in the oil, gas, and energy industry. The company specializes in exploration, production, and distribution of oil, gas, and derivative products. SAExploration is an American energy company that provides seismic data acquisition services for the oil and gas industry. They specialize in deep water ocean bottom projects and challenging land operations. |
||||||
| Ransomware | UNDER ARMOUR id23945 View details | United States | Manufacturing / Engineering | — | ||
|
[AI generated] Under Armour, Inc. is an American multinational corporation founded in 1996 by Kevin Plank. The company specializes in manufacturing and selling branded performance apparel, footwear, and accessories. Its products are engineered with innovative technologies to mitigate the impact of environmental conditions on physical activities. Headquartered in Baltimore, Maryland, it caters extensively to the sports industry globally. |
||||||
| Ransomware | Svenska kraftnät Database on sale for $2 Million id23940 View details | Sweden | Other | — | ||
|
Svenska kraftnät is Sweden’s national power grid operator, responsible for transmitting electricity and maintaining the country’s high-voltage grid. In this threat-intelligence listing, the entity is presented as a database on sale for $2 million, reflecting a ransomware-style extortion claim rather than a verified service outage or operational disruption. Public reporting says Svenska kraftnät described the incident as affecting an external file transfer system while stating that electricity supply and mission-critical systems were not impacted. The listing was associated with Everest and categorized as a ransomware victim. |
||||||
| Ransomware | Svenska kraftnät 280GB Database on sale id23939 View details | Sweden | Other | — | ||
|
Svenska kraftnät is Sweden’s state-owned electricity transmission system operator, responsible for managing the national power grid and maintaining reliable transmission across the country. It operates in the other sector and is based in Sweden (SE), where it plays a central role in electricity system stability and grid coordination. The listing label indicates a database reportedly offered for sale, framed around a claimed 280GB dataset associated with the organization. It was listed as a ransomware victim associated with everest. |
||||||
| Ransomware | FullBeauty Brands id23853 View details | United States | Communication / Marketing | pending | ||
|
[AI generated] FullBeauty Brands is a US-based plus-size women's and men's apparel and home goods company. The company operates multiple brands such as Woman Within, Roaman's, Jessica London, Ellos, Swimsuits For All, KingSize, and BrylaneHome. It is committed to providing stylish, high-quality products in sizes that are traditionally hard to find. |
||||||
| Ransomware | Svenska Kraftnät data id23852 View details | Sweden | Public Sector | — | ||
|
Svenska Kraftnät is Sweden’s state-owned transmission system operator, responsible for managing and developing the national electricity grid. Based in Sundbyberg, it serves the public sector by ensuring the country’s power transmission is safe, environmentally sound, and cost-effective. Its activities include operating the grid and supporting related energy-system data and coordination. In threat-intelligence indexing, Svenska Kraftnät data was listed as a ransomware victim associated with everest. |
||||||
| Ransomware | Vikor Scientific, LLC / Korgene id23838 View details | United States | Healthcare / Pharma | — | ||
|
[AI generated] Vikor Scientific, LLC / Korgene is a specialized molecular diagnostics company dedicated to advancing the healthcare sector through innovation. They offer comprehensive, customized diagnostic tests to clinicians for better patient outcomes. Vikor aims to combat the rise of antibiotic resistance by providing targeted treatments. Korgene, on the other hand, develops efficient diagnostic platforms to detect diseases like cancer. |
||||||
| Ransomware | KorPath id23837 View details | Korea, Republic of | IT | leaked | ||
|
[AI generated] KorPath is a biotechnology company that specializes in early-stage technologies. Their main focus is on identifying unique compounds and molecules that can be used in various medical interventions. The company conducts extensive research on pathological conditions including cancer and neurodegenerative disorders. They also offer preclinical services such as ex vivo efficacy studies. |
||||||
| Ransomware | Dublin Airport - Database Leaked id23794 View details | Ireland | Transportation / Travel / Logistics | — | ||
|
Dublin Airport is Ireland’s primary international airport, serving the Dublin metropolitan area and handling passenger air travel, baggage, and airport operations for domestic and international routes. It operates within the transportation and travel sector and functions as a major aviation gateway for the country. The listing title “Database Leaked” refers to a threat-intelligence entry tied to alleged data exposure activity involving the airport. In the threat index, Dublin Airport - Database Leaked was listed as a ransomware victim associated with everest. |
||||||
| Ransomware | Collins Aerospace / RTX.com - Database Leaked id23793 View details | United States | Communication / Marketing | — | ||
|
rtx.com is the corporate website for RTX Corporation, a US-based aerospace and defense company headquartered in Arlington, Virginia. The company says it serves commercial aerospace and defense customers and operates through Collins Aerospace, Pratt & Whitney, and Raytheon, offering technologies and services across those markets. RTX also presents itself as a global technology business focused on advanced engineering and innovation for government and commercial clients. In threat-intelligence indexing, rtx.com was listed as a ransomware victim associated with everest. |
||||||
| Ransomware | SIAD id23789 View details | Italy | Healthcare / Pharma | leaked | ||
|
[AI generated] SIAD is a leading international group operating in the production and sale of industrial and medical gases, engineering, healthcare, and training services. Founded in 1927 in Italy, the company develops, produces, and supplies a range of gases including oxygen, nitrogen, argon, carbon dioxide and hydrogen. SIAD also offers medical gases for healthcare industries, gas equipment, and systems for gas production and treatment. |
||||||
| Ransomware | AGFA id23788 View details | Belgium | Healthcare / Pharma | — | ||
|
[AI generated] AGFA, short for AktienGesellschaft für Anilin-Fabrikation, is a multinational company that develops, manufactures, and distributes analogue and digital imaging systems and IT solutions. The company's history traces back to 1867 in Berlin, Germany. The company operates in four divisions: health care, graphic systems, materials, and glass. Products include systems for radiology, cardiology, hospital and clinical care, printing and publishing industries. |
||||||
| Ransomware | Everest Exclusive Interview for Dailydarkweb.net id23652 View details | Other | — | |||
|
[AI generated] N/A |
||||||
| Ransomware | AT&T Careers - Database Leaked id23453 View details | United States | Other | — | ||
|
[AI generated] N/A |
||||||
| Ransomware | Dublin Airport DataBase on sale for $1 Million id23452 View details | Ireland | Transportation / Travel / Logistics | — | ||
|
Dublin Airport DataBase on sale for $1 Million is a victim listing tied to Dublin Airport, the major air transport hub serving Dublin, Ireland, in the Transportation / Travel sector. The listing reflects a claimed cyberextortion event involving airport-related data, and the threat-intelligence entry associates it with an Everest ransomware campaign. As cataloged in threat-intelligence sources, the case centers on the airport environment rather than a product offering, and it is tracked as a ransomware victim in Ireland. It was listed as a ransomware victim associated with everest. |
||||||
| Ransomware | Air Arabia DataBase on sale for $2 Million id23439 View details | Other | — | |||
|
[AI generated] N/A |
||||||
| Ransomware | MotorsportMarkt.de id23392 View details | Germany | Communication / Marketing | — | ||
|
[AI generated] "MotorsportMarkt.de" is a German company that operates an online portal specializing in the market for motorsports. It provides a marketplace for buying and selling of motorsport vehicles, parts, equipment, and accessories. Additionally, it offers listings for motorsport-related jobs, properties and services. The platform corresponds to a broad range of motorsport disciplines including cars, motorcycles, karts, and offroad vehicles. |
||||||
| Ransomware | ANIA KRUK id23391 View details | Poland | Other | leaked | ||
|
[AI generated] ANIA KRUK is a Polish luxury jewelry brand that has been creating high-quality accessories since 1986. Founded by Ania Kruk, the company offers a wide variety of jewelry crafted in the finest materials like silver, gold, and diamonds. ANIA KRUK’s collections are known for their modern designs, uniqueness and high-quality craftsmanship. They operate online and have several boutiques across Poland and internationally. |
||||||
| Ransomware | Dublin Airport id23796 View details | Ireland | Transportation / Travel / Logistics | leaked | ||
|
[AI generated] Dublin Airport, located in Collinstown, Fingal, Ireland, is an international airport serving Dublin, the capital city of Ireland. It is operated by DAA (Dublin Airport Authority). The airport is the 12th busiest in Europe, offering flights to over 180 destinations by more than 40 airlines. It boasts two terminals, numerous shops and eateries, and various transport options including taxis, buses, and car rentals. |
||||||
| Ransomware | Air Arabia id23344 View details | United Arab Emirates | Transportation / Travel / Logistics | — | ||
|
[AI generated] Air Arabia is a low-cost airline that started its operations in 2003, based in Sharjah, United Arab Emirates. The company offers flights to over 170 destinations across the Middle East, North Africa, Asia, and Europe. Apart from passenger transportation, Air Arabia also has diversified into travel management, tourism, and hospitality through various subsidiaries. It operates a fleet of Airbus A320 aircraft. It's the first publicly listed airline in the Middle East, priding itself on being a profitable venture since the second year of its operation. |
||||||
| Ransomware | Svenska Kraftnät id23343 View details | Sweden | Energy | — | ||
|
[AI generated] Svenska Kraftnät is a Swedish state-owned energy company responsible for the nation's transmission grid for electricity. It operates on a national level ensuring the balancing of supply and demand for electricity. It manages the transmission grid (about 15,000 km of high voltage lines) and ensures that the grid is safe, reliable, and efficient. It also coordinates the cross-border exchanges of electricity and guarantees a balanced energy market. |
||||||
| Ransomware | AT&T Careers id23283 View details | United States | IT | — | ||
|
[AI generated] AT&T Careers is the employment division of AT&T, an American multinational conglomeric communications company. It offers opportunities in various fields including technology, sales, marketing, customer service, cybersecurity. The company seeks individuals interested in the tech industry with drive for innovation. Roles include internships, entry-level, management, and more experienced positions. It provides competitive benefits and a diverse, inclusive workplace. |
||||||
| Ransomware | Collins Aerospace Admits Responsibility for Flight Chaos at Heathrow, Brussels and Other M... id23221 View details | United States | Other | — | ||
|
[AI generated] N/A |
||||||
| Ransomware | Collins Aerospace / RTX.com id23795 View details | United States | Services | — | ||
|
[AI generated] Collins Aerospace, a unit of Raytheon Technologies Corporation, is a leader in technologically advanced, intelligent solutions for the global aerospace and defense industry. Created in 2018 by bringing together UTC Aerospace Systems and Rockwell Collins |
||||||
| Ransomware | MUSE-INSECURE: Inside Collins Aerospaces Security Failure id23186 View details | Other | — | |||
|
[AI generated] N/A |
||||||
| Ransomware | Colins Aerospace / RTX.com id23180 View details | United States | Other | — | ||
|
[AI generated] N/A |
||||||
| Ransomware | MUSE-INSECURE: Inside Colins Aerospaces Security Failure id23179 View details | United States | Other | — | ||
|
[AI generated] N/A |
||||||
| Ransomware | Streebo id22978 View details | United States | IT | — | ||
|
[AI generated] "Streebo" is an established global IT solutions company, specializing in AI-powered digitization services and products. With a focus on Automation, Mobile and AI technology, Streebo develops digital experiences for industries like banking, healthcare, eCommerce, & telecommunication. Renowned for its consultative approach, Streebo partners with businesses to reshape and renovate their digital landscape, aiding in their overall growth and efficiency. |
||||||
| Ransomware | BMW id22451 View details | Germany | Communication / Marketing | — | ||
|
[AI generated] BMW, officially known as Bayerische Motoren Werke AG, is a German multinational corporation renowned for manufacturing high-quality automobiles and motorcycles. Established in 1916, the company's headquarters is in Munich, Germany. The brand represents luxury and performance, offering diverse models under various segments like sports cars, EVs, luxury sedans, and SAVs. BMW also owns and produces Mini cars and is the parent company of Rolls-Royce Motor Cars. |
||||||
| Ransomware | MFO ITALIA id22369 View details | Italy | Finance / Legal / Insurance | — | ||
|
[AI generated] "MFO ITALIA" is a niche finance company that specialises in short and medium term loans for Italian-based enterprises. These loan services offered by MFO ITALIA are designed to meet the financing needs of private businesses, fostering growth and development in different sectors. They have a strong focus on reliability, trust, and securing the financial future of their partner firms. |
||||||
| Ransomware | Key 4 Energy Srl id22368 View details | Italy | Energy | — | ||
|
[AI generated] Key 4 Energy Srl is an Italy-based company specializing in the optimization of energy resources. Dedicated to promoting sustainable energy, they aim to improve energy efficiency, reduce energy costs, and lessen the environmental impact. They provide services like energy diagnostics, energy audits, energy management, and renewable energy projects for businesses, offering solutions that combine economic sustainability with environmental protection. |
||||||
| Ransomware | Studio Legale Tisot Iuris id22367 View details | Italy | Finance / Legal / Insurance | leaked | ||
|
[AI generated] "N/A" |
||||||
| Ransomware | Professional Trust Company id22366 View details | Italy | Communication / Marketing | leaked | ||
|
[AI generated] N/A |
||||||
| Ransomware | Groupe Clarins id22358 View details | France | Communication / Marketing | leaked | ||
|
[AI generated] Groupe Clarins is a French luxury cosmetics company, which develops skincare, makeup and fragrances products. Founded in 1954 by Jacques Courtin-Clarins, the company originally began as a small Parisian beauty institute. Today, the company is present worldwide, known for its plant-based high-end skincare products. In 2018, it was ranked first for high-end facial skincare brands in Europe. |
||||||
| Ransomware | Everest file server id22232 View details | Other | — | |||
|
[AI generated] N/A |
||||||
| Ransomware | Allegis Group id22231 View details | United States | Services | — | ||
|
[AI generated] Allegis Group is a privately-held global talent solutions provider. The company offers a wide range of services, such as staffing and recruitment, workforce management, and talent advisory. Their expertise includes IT & communications, aerospace, biopharmaceuticals, energy, financial services, and more. Allegis was founded in 1983 and has its headquarters in Hanover, Maryland, USA. |
||||||
| Ransomware | Aupaircare and Intraxinc id22230 View details | United States | Communication / Marketing | leaked | ||
|
[AI generated] AuPairCare and Intrax Inc. are sister companies. AuPairCare is a leading au pair agency providing live-in childcare services to American families in over 40 states. It pairs host families with international young adults who provide up to 45 hours of childcare each week. Intrax Inc. on the other hand, is a globally-oriented company providing a variety of educational and cultural exchange programs, including work and internship, teaching, and language learning opportunities. |
||||||
| Ransomware | Easy Credit id22180 View details | Germany | Finance / Legal / Insurance | pending | ||
|
[AI generated] Easy Credit is a financial services company specializing in providing accessible and affordable personal loans to customers. The company operates with a customer-centric approach, offering immediate loan approval and disbursement processes. Easy Credit's services are designed to offer financial solutions to individuals and businesses with flexible repayment plans, catering to various financial needs. |
||||||
| Ransomware | Cordeiro Guerra & Associati id22086 View details | Italy | Other | — | ||
|
[AI generated] N/A |
||||||
| Ransomware | Everest file server now online id22015 View details | Other | leaked | |||
|
[AI generated] N/A |
||||||
| Ransomware | Matiss id21807 View details | Latvia | Communication / Marketing | — | ||
|
[AI generated] "Matiss" is a company that specializes in automation and robotics. Its operations span various sectors including food processing, packaging, and logistics. Matiss's main products include robotic pick and place systems, conveyor systems, and sorting systems. The company is known for using advanced technology to improve efficiency and productivity for their clients. They provide end-to-end automation solutions, from initial design to installation and maintenance. |
||||||
| Ransomware | DAT AUTOHUS AG id21760 View details | Germany | Finance / Legal / Insurance | — | ||
|
[AI generated] DAT AUTOHUS AG is a Germany-based company that specializes in the sale of new and used vehicles. It offers a wide array of cars, including compact cars, sedans, SUVs, sports cars, and commercial vehicles from various brands. The company also provides services such as financing, leasing, insurance, and car maintenance and repair. It's located in Bockel, Gyhum, Germany. |
||||||
| Ransomware | Philadelphia Investment Partners id21759 View details | United States | Finance / Legal / Insurance | — | ||
|
[AI generated] Philadelphia Investment Partners is a private investment firm that focuses on global and international equities. Tracing its roots back to the 1980s, the company seeks to provide high net-worth investors, corporate pension funds, endowments, and foundations with superior investment performance and service. |
||||||
| Ransomware | Voltus GmbH id21758 View details | Germany | Energy | — | ||
|
[AI generated] Voltus GmbH is a German company that provides demand-side energy management service. It specializes in distributed energy resources, focused on aggregated load reduction and energy efficiency, enabling customers in industrial and commercial sectors to decrease their energy usage. The company's platform aggregates small resources into distributed networks of demand management assets that interact with energy markets, saving cost and resources. |
||||||
| Ransomware | BRIJU.PL id21757 View details | Poland | Communication / Marketing | — | ||
|
[AI generated] BRIJU.PL is a leading Polish company that specializes in the production and distribution of silver and gold jewelry. Their product range includes rings, necklaces, bracelets, earrings, and pendants, some of which are adorned with precious stones. The company offers its products via their online platform as well as through a network of stores across Poland. BRIJU.PL focuses on offering high-quality products and exceptional customer service. |
||||||
| Ransomware | MYVISAJOBS.COM id21756 View details | United States | Communication / Marketing | — | ||
|
[AI generated] MYVISAJOBS.COM is a website that helps international students and professionals seeking work in the United States. The platform provides information about job sponsors, visa filings, employment, immigration attorneys, etc. Their data is collected from various U.S. federal agencies. The company aims to help immigrants secure suitable employment in the U.S. and navigate through the visa process efficiently. |
||||||
| Ransomware | Viking Automation id21631 View details | Norway | Other | — | ||
|
[AI generated] N/A |
||||||
| Ransomware | Pacific HealthWorks id21625 View details | United States | Healthcare / Pharma | leaked | ||
|
[AI generated] Pacific HealthWorks is a management services organization based in Los Angeles, United States. The company primarily provides comprehensive management, administrative, and support services to healthcare practitioners and facilities, including doctors’ offices, healthcare clinics, and other related medical entities. They focus on business and operational aspects so the medical professionals can concentrate on patient care. |
||||||
| Ransomware | La Perouse id21626 View details | United States | Retail / E-commerce | leaked | ||
|
La Perouse Is your One-Stop-Shop for complete revenue cycle management. Let us help you focus on what you do best. |
||||||
| Ransomware | BRUNTON-SHAW.COM id21571 View details | United Kingdom | Energy | — | ||
|
[AI generated] Brunton Shaw is a company based in the UK that specializes in the manufacture of wire and rope solutions. It offers high performance ropes for various sectors including construction, mining, oil, gas, and renewable energy. The company is well-known for delivering reliable and durable products with an emphasis on quality and innovation. It has global presence with an extensive distribution network. |
||||||
| Ransomware | Brunton-Shaw id21561 View details | United Kingdom | Communication / Marketing | — | ||
|
[AI generated] Brunton-Shaw is a prominent UK-based company that specializes in manufacturing and supplying of high-quality wire ropes and wire rope-related products. Their primary markets are in the oil, gas, mining, structures and elevator sectors, among others. They have a world-wide customer base thanks to their reputation for meeting stringent quality requirements and delivery schedules. |
||||||
| Ransomware | EMMCORP.COM id21560 View details | United Kingdom | Services | — | ||
|
[AI generated] N/A |
||||||
| Ransomware | iPROMOTEu id21460 View details | United States | Communication / Marketing | — | ||
|
[AI generated] "iPROMOTEu" is a US-based service provider in the promotional products industry. Established in 1999, it offers services such as order financing, supplier negotiation, and business development to promotional product distributors. The company aims to help these distributors increase their efficiency, reduce costs, and maximize their business potential, while also allowing them to retain their independence. |
||||||
| Ransomware | Grayscale Investments id21459 View details | United States | Finance / Legal / Insurance | leaked | ||
|
[AI generated] Grayscale Investments is a digital currency asset management company, founded by Barry Silbert in 2013. It provides secure access to the digital currency asset class through its single-asset and diversified investment products, including Grayscale Bitcoin Trust and Grayscale Digital Large Cap Fund. It operates in the US and has the distinction of managing the largest Bitcoin portfolio. |
||||||
| Ransomware | Mailchimp id21458 View details | United States | Communication / Marketing | — | ||
|
[AI generated] Mailchimp is a leading marketing automation platform and an email marketing service. The platform allows businesses to design, schedule, and manage email campaigns, from large to small scale. With additional features like audience segmentation, dynamic content, and analytics, it caters to businesses looking to turn their audience data into actionable insights. It also grants users the ability to build websites and landing pages. |
||||||
| Ransomware | Crumbl - Full leak published id21456 View details | United States | Other | — | ||
|
[AI generated] N/A |
||||||