Updated November 7, 2026: This profile covers Everest’s ransomware, data-extortion and access-brokerage operations, the October 2026 PwC vendor incident, and the distinction between confirmed victim disclosures and the group’s unverified claims.
First observed: December 2020.
Type: Financially motivated ransomware and data-extortion operation with initial access brokerage.
Attribution: Russian-speaking cybercrime operation, according to security researchers. Language and malware similarities do not establish state sponsorship.
Primary operations: Data theft, extortion, ransomware deployment, access sales and advertised insider recruitment.
Targeting: Multiple sectors worldwide, including healthcare, financial services, professional services, construction and government.
Status: Active in recent vendor reporting, with October 2026 extortion claims. Attribution and impact require incident-specific verification.
Everest is not simply a ransomware executable. It is a cybercrime operation that can make money by stealing information, threatening publication, encrypting systems or selling access to another attacker. A company appearing in an Everest claim does not, by itself, prove that ransomware ran inside its network.
That distinction is central to the group’s 2026 activity. Recent BreachNews coverage includes vendor-related incidents and alleged data theft, while the technical history documents ransomware capabilities that should not automatically be assigned to every new victim claim.
Latest activity centers on stolen-data claims
During the latest 90-day reporting window, the clearest new development in BreachNews coverage was the October incident involving PwC. Everest alleged on October 22 that it had stolen approximately 590 GB of information associated with the firm.
PwC acknowledged an incident at an external provider hosting employee learning records on October 23. The company said the affected environment did not contain client data, sensitive personal information or financial records, and that its internal network and operations were unaffected.
PwC’s acknowledgment does not confirm Everest’s claimed volume, every alleged data category or ransomware deployment. The distinction is preserved in BreachNews coverage of the PwC vendor incident.
A Halcyon profile updated November 5, 2026 describes Everest as active and says its recent activity emphasized data-theft extortion. That supports continued monitoring, not a verified count of successful intrusions.
From data theft to a mixed criminal business
The U.S. Department of Health and Human Services Health Sector Cybersecurity Coordination Center, or HC3, dates Everest’s emergence to at least December 2020. Its August 20, 2024 threat actor profile describes an operation that initially focused on exfiltration before moving into ransomware.
HC3 says access-broker activity was observed by November 2021 and became a greater focus in 2023. This model separates the theft of a foothold from whatever another criminal later does with it. The seller of access and the operator deploying ransomware need not be the same person.
Researchers have linked Everest ransomware to the EverBe 2.0 lineage and identified technical similarities with BlackByte. Code relationships are not proof that the groups have identical membership, leadership or infrastructure.
Valid accounts and ordinary tools enable intrusions
HC3 documents compromised accounts and remote services as important parts of Everest-associated activity. Once inside, attackers can use legitimate credentials and Remote Desktop Protocol to move between systems, making unusual account behavior more useful to defenders than a single suspicious filename.
The advisory describes ProcDump being used to collect credential material from the LSASS process, copying of the Active Directory database, network discovery with SoftPerfect Network Scanner, and WinRAR archives prepared before exfiltration.
Cobalt Strike and remote administration products such as AnyDesk, Splashtop and Atera provide additional access or communications channels. Those are legitimate tools with authorized uses. Their presence alone does not establish an Everest intrusion.
HC3 also describes attackers deleting tools, discovery output and archives. Investigators should preserve centralized authentication, endpoint and network logs quickly rather than assume missing local files mean no compromise occurred.
Insider recruitment requires careful interpretation
Everest-associated operators have advertised payments for corporate access since at least October 2023. Security researchers describe offers aimed at organizations in the United States, Canada and Europe.
HC3 adds an important qualification: advertised remote access may come from other criminals who already compromised an organization. An offer to buy access is not evidence that a particular employee cooperated or that a named victim suffered insider betrayal.
For defenders, the issue is still practical. Access reviews, limits on third-party administration, rapid removal of departed users and confidential reporting channels can reduce exposure without assuming employees are involved in wrongdoing.
Encryption remains a capability, not an automatic finding
A July 10, 2026 Picus analysis describes a Windows-focused Everest encryptor that generates key material locally and appends an Everest extension to encrypted files. The analysis also documents attempts to weaken defenses and destroy recovery options.
Those findings concern analyzed malware, not a forensic account of the PwC incident or every 2026 claim. A current claim may involve data-only extortion, while a historical sample may still show destructive encryption capabilities.
Backups address availability, but do not reverse data theft. Organizations need a response plan that handles both restoration and the privacy, notification and impersonation risks created by stolen information.
Notable claims and confirmed disclosures
Citizens Financial Group provides a useful example of scope discipline. In its April 21, 2026 statement, Citizens confirmed an incident involving data extracted from a third-party vendor. It said most material was masked test data, with a limited amount involving a small number of customers, and no evidence of unauthorized access to its own network.
That is not confirmation of Everest’s claim to possess 3.4 million records. Similarly, BreachNews reported an alleged STIIIZY dataset involving about 420,000 customer records and a Rehab Clinics Group claim involving sensitive treatment-related communications. Their claimed contents and scale should not be treated as independently verified findings.
The healthcare implications are particularly serious because exposure of treatment information can cause harm even without an operational outage. HC3 identified a recurring focus on U.S. medical-imaging providers, but its historical statistics should not be presented as a current 2026 victim census.
Disruption and accountability remain separate questions
The reviewed government advisory and current vendor profiles do not establish a completed law enforcement takedown of Everest. Nor do they provide a verified public roster of its operators.
Reports of disruption to a criminal website are not equivalent to an arrest, a sanctions designation or dismantling the operation. Organizations assessing a payment must obtain current legal advice and conduct sanctions checks rather than infer safety from the absence of an Everest-specific action in this profile.
Defensive priorities against the hybrid model
- Require strong multifactor authentication for remote access and remove unnecessary internet-exposed administration services.
- Review privileged accounts and vendor access, and investigate unusual logins or newly installed remote support tools.
- Monitor credential dumping, broad network discovery, unexpected archives and large outbound transfers as a sequence rather than isolated events.
- Keep protected offline or immutable backups and test recovery independently of the production environment.
- Preserve logs, confirm the affected dataset and prepare clear notifications before repeating an attacker’s figures.
All Everest coverage from BreachNews
- PwC confirms vendor incident as Everest claims 590 GB theft.
- Everest reportedly claims STIIIZY customer records.
- Everest claims Rehab Clinics Group treatment-related data.
- Citizens Bank claim and the company’s vendor-incident clarification.
Threat assessment
Everest’s durability comes from flexibility: access itself, stolen information and encryption can each create leverage. Defenders should track the operation as a continuing criminal threat while testing every victim claim against company disclosures and technical evidence. Attribution, data volume and encryption are separate questions, not interchangeable conclusions.
Changelog
November 7, 2026: Initial profile with HC3’s technical baseline, 2026 vendor research, the PwC development, Citizens’ clarification and the complete relevant BreachNews coverage archive.
