Everest

Everest is a threat actor group known for its malicious activities, including ransomware attacks and unauthorized access to various organizations' networks. This Russian-speaking entity was first observed operating as an initial access broker in November 2021. The group has targeted a broad range of sectors including healthcare, construction and engineering, financial services, legal and professional services, manufacturing, and government. They exploit weak or stolen credentials to gain access to multiple systems within a target organization and use tools like ProcDump to create copies of the LSASS process, enabling them to extract additional credentials. Everest is also known to utilize legitimate cybersecurity threat simulation tools such as Cobalt Strike to facilitate their attacks. In 2021, the French law firm Cabinet Remy Le Bonnois paid the Everest group $30,000 to resolve an attack. In October, Cybernews reported that Everest claimed to have hacked AT&T and was selling access to the corporate network in the U.S. Furthermore, the group reportedly had an insider within the Illinois court system, granting them unrestricted access to confidential documents and sensitive data. This information was based on a statement made by Everest on a dark web forum, accompanied by screenshots allegedly showing their access to the court's systems. The ransomware strain used by Everest has been linked to the EverBe 2.0 family and, more recently, to the Russia-based ransomware group BlackByte. As an initial access broker, Everest sells unauthorized access to other cybercriminals who conduct ransomware attacks. This evolution into an 'initial access broker' signifies their role in the underground Russian ransomware economy, facilitating ransomware attacks by initially gaining unauthorized access to victim organizations through means such as credential theft. The American Hospital Association issued a warning about Everest threats following an alert from HHS HC3.