Everest Ransomware Decryption & Data Recovery

Everest first appeared in December 2020 and began naming victims on its Tor leak site in September 2021. By September 2026 public trackers had recorded roughly 400 listed organisations across dozens of countries - one of the few extortion crews to run continuously for more than five years. It is not a RaaS operation: there is no public affiliate programme, and samples abort on CIS locales, consistent with the assessment that this is a closed Russian-speaking group.

Three parallel revenue streams distinguish it: deploying an encryptor for ransom; brokering initial access to corporate networks since November 2021; and, since October 2023, openly recruiting corporate insiders for a profit share. The last two mean the entry point is not always a technical intrusion - it may be a bought employee account. Healthcare is the most represented sector, followed by technology and professional services, then finance, government, manufacturing and aviation; close to a third of listed victims are US-based, and US healthcare-sector authorities have issued a dedicated advisory on the group.

In April 2025 the leak site was breached, defaced and briefly taken offline; posting resumed within weeks. More significantly, the operation has tilted towards pure data theft: in autumn 2025 it posted a Collins Aerospace MUSE / vMUSE claim and tied it to the September 2025 check-in disruption at several European airports, and in February 2026 it claimed a large dataset from records-management provider Iron Mountain. Such claims need independent verification - reverse engineering from the same period found no exfiltration code in the encryptor itself, while the notes still assert that "approximately 1 TB" was taken.

For Chinese enterprises the exposure sits with overseas subsidiaries, cross-border branches and supply-chain partners: one stale leaked credential, one remote entry point without MFA, or one bought account is enough.

Extension and naming. The .everest suffix (uppercase .EVEREST in some builds) is appended to the original filename, which is otherwise left intact. Files above 10 MB are renamed in place and partially overwritten, so no second copy appears on disk.

Ransom note. EVERESTRANSOMWARE.txt - transcribed in some reports as EVEREST LOCKER .txt, so confirm the exact spelling against the sample - is dropped into C:\ProgramData, the desktop and every traversed directory. It opens with "Greetings from the Everest team" and hardcodes the victim organisation's name, showing the sample was compiled for that target. Contact is via a Tox ID and an onion page.

Host-side corroboration. Wallpaper replaced; SMBv1 and Network Discovery re-enabled; a text file listing discovered UNC paths under ProgramData; unmounted volumes force-assigned drive letters; Image File Execution Options entries and scheduled tasks for the anti-ransomware tool Raccine removed; shadow storage resized to 401 MB; Recycle Bin emptied and security, backup and database services disabled.

A misidentification worth avoiding. The 2018 Everbe / InsaneCrypt lineage also used .EVEREST (as .[email].EVEREST) and is unrelated to this crew. Judging on the extension alone leads to the wrong recovery path.

Confirm whether encryption even happened. A substantial share of Everest cases are exfiltration-only. Being named on the leak site while every file remains readable is normal here, and that scenario follows an entirely different response path.

Everest's access playbook rests on valid credentials and exposed remote entry points:

• Internet-facing RDP without MFA, ranked first across public reporting.
• Vulnerable or weakly protected VPN endpoints and public-facing applications, including legacy services that were never decommissioned.
• Purchased and reused credentials from initial access brokers, credential stuffing and infostealer logs. Public tracking data associates infostealer logs with around 60% of Everest's listed victims, and several large cases have been traced back to credentials leaked years earlier that were never rotated - including file-transfer accounts left behind by decommissioned services.
• Phishing for loader delivery.
• Insider recruitment. Since October 2023 the group has openly paid employees for access or data, bypassing most perimeter and endpoint controls; least privilege and behavioural auditing are the only real countermeasures.

Lateral movement includes one unusual step: the encryptor parses the local ARP cache for recently contacted MAC addresses and sends Wake-on-LAN magic packets over UDP ports 7 and 9 to bring powered-off or sleeping hosts online before enumerating and encrypting them. The assumption that "machines shut down that night were safe" does not hold here.

Note also that no exfiltration code was found in the reverse-engineered encryptor. Data theft happens earlier with separate tooling, so the volume claimed in the note and the encryption activity seen on endpoints are two independent evidence chains.

Encryptor form. A .NET Framework 4.0 binary packed with ConfuserEx, compiled per victim.

Algorithms. The code declares AES-256 and RSA-4096 but downgrades at runtime to AES-128-CBC, with the key seed wrapped under an RSA-1024 public key. The seed is 32 printable ASCII characters drawn from System.Random (seeded off Environment.TickCount) and passed through PBKDF2 with a static 8-byte salt and 1,000 iterations to derive the key and IV. Keys are generated entirely on the victim host with no C2 dependency - a design closely matching the BlackByte C# variant and the basis for researchers linking the two codebases.

Encryption scope, the part that decides recovery. Files up to 10 MB are fully encrypted; files above 10 MB are renamed in place and encrypted in roughly six non-contiguous regions with no padding. Large files - databases, virtual disks, mail stores, imaging and backup archives - therefore often retain substantial untouched original data. That intact remainder is the entire basis for structural repair later; small files offer no such margin.

Recovery inhibition. All volume shadow copies are deleted and shadow storage resized to 401 MB to force a purge, restore points are removed, the Recycle Bin emptied, backup-related files deleted, security, backup and database services disabled, Controlled Folder Access turned off, and deny ACEs applied to the encryptor's own process to resist termination.

Geofencing and platforms. Execution aborts on CIS locales. Public analysis covers Windows only and no confirmed Linux or ESXi encryptor has been published, though SMB shares reachable in the domain - including those hosted on NAS devices - are encrypted along with local volumes. The leak site runs countdown timers and staged publication.