CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Everest

actor · actor:everest-ransomware

Russian-speaking closed-group double-extortion ransomware / initial-access-broker operation that emerged in December 2020 with a code-level connection to BlackByte; runs an IAB service (since Nov 2021) and a paid corporate-insider recruitment programme (since Oct 2023); documented initial access via internet-exposed RDP without MFA and vulnerable VPN endpoints (Halcyon threat-actor profile, 2025-11-19). Claimed the July 2026 breach of a Stadler Rail supplier data-exchange platform (CHF 10M demand, refused; swissinfo.ch / Swiss IT Magazine, 2026-07-21). Per the Halcyon profile the group also claimed, in October 2025, attacks on a European national electricity-transmission operator, aviation systems at multiple European airports, and telecom networks, the group's own leak-site claims, unconfirmed by the named victims.

Coverage
1
first 2026-07-22 → last 2026-07-31
Latest activity
2026-07-31
Everest reaches Stadler Rail through a supplier's data-exchange platform, not Stadler's own perimeter
Peak priority
notable
1 notable
Targets
transport
sectors: transport, manufacturing · regions: switzerland, europe, dach
Sources cited
6
6 hosts

Defender insights

What each entry about Everest tells a defender to do, newest first.

2026-07-22NOTABLEEverest reaches Stadler Rail through a supplier's data-exchange platform, not Stadler's own perimeter

Latest update

Relationships explore in graph

Typed, source-stated connections from the entity registry; each edge cites the entry whose reporting establishes it.

attributed activity

Story timeline

  1. 2026-07-22Everest ransomware breaches a Stadler Rail supplier data-exchange platform, demands CHF 10 million, the Swiss rail manufacturer refuses to pay
    active-threatsEverest reaches Stadler Rail through a supplier's data-exchange platform, not Stadler's own perimeter

Hunting pivots

Tags
data-breachorganized-crimeransomwaresupply-chain
ATT&CK techniques (2 across 4 tactics)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessValid Accounts · Trusted Relationship
  • PersistenceValid Accounts
  • Privilege EscalationValid Accounts
  • StealthValid Accounts

Initial Access TA0001

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-07-22/everest-ransomware-stadler-rail-supplier-platform-breach · ATT&CK page ↗

T1199Trusted Relationship×1

Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship abuses an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network.

Evidence: 2026-07-22/everest-ransomware-stadler-rail-supplier-platform-breach · ATT&CK page ↗

Persistence TA0003

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-07-22/everest-ransomware-stadler-rail-supplier-platform-breach · ATT&CK page ↗

Privilege Escalation TA0004

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-07-22/everest-ransomware-stadler-rail-supplier-platform-breach · ATT&CK page ↗

Stealth TA0005

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-07-22/everest-ransomware-stadler-rail-supplier-platform-breach · ATT&CK page ↗

Entries about Everest (1)

2026-07-22 · view entry permalink →

NOTABLEupdatedNATOB2

Everest ransomware breaches a Stadler Rail supplier data-exchange platform, demands CHF 10 million, the Swiss rail manufacturer refuses to pay

Stadler Rail disclosed on 2026-07-21 that unauthorised parties gained access, in mid-July, to a data-exchange platform Stadler uses with an (unnamed) supplier, and that the Everest ransomware/extortion group claimed the intrusion and demanded a CHF 10 million ransom (swissinfo.ch, 2026-07-21). Stadler states it does not pay ransoms under any circumstances, has filed a criminal complaint with Thurgau cantonal police, and reports that its own IT systems were unharmed, no security-relevant or personal data was stolen, and worldwide rail-vehicle production and in-service fleets are unaffected; the accessed information belonged to the supplier and is described as not security-relevant (Swiss IT Magazine, 2026-07-21).

Everest is a Russian-speaking, closed-group double-extortion operation that emerged in December 2020, with a code-level connection to the BlackByte ransomware family; it has run hybrid Initial Access Broker services since November 2021 and a corporate-insider recruitment programme offering cash/profit-sharing since October 2023, and its documented infection vectors are internet-exposed RDP without MFA, vulnerable VPN endpoints, and credentials bought from other brokers (Halcyon, 2025-11-19). Per the same profile the group claimed, in October 2025, attacks on critical infrastructure including a European national electricity transmission operator, aviation systems affecting multiple European airports (Heathrow, Brussels and Berlin), and telecommunications networks, recurring targeting of the European critical-infrastructure and transport space, though those victim claims are the group's own leak-site assertions and are unconfirmed by the named organisations.

Ein von der cyberkriminellen Everest Group gefordertes Lösegeld in Höhe von zehn Millionen Franken bezahlte die Firma laut Mitteilung nicht

Die Produktion laufe aktuell weltweit normal weiter

swissinfo.ch 2026-07-21

According to the threat actor, which was first flagged by threat-intelligence tracker HackManac, the data breach yielded a 201 GB FTP archive holding more than 271,000 files.

Everest claims the compromised data touches projects linked to several high-profile operators, including Deutsche Bahn, Merseytravel, Westbahn, and MTR, alongside other unnamed clients. If validated, exposure of engineering documentation and system configurations tied to these operators raises concerns around downstream risk to connected railway infrastructure.

TechNadu 2026-07-29

Stadler hat durch den Vorfall von Mitte Juli 2026 keine Daten verloren. Der Zugriff auf diese spezifischen, technischen Daten erfolgte über kompromittierte Zugangsdaten einer Datenaustausch-Plattform.

Stadler Rail 2026-07-21
Updaterun 2026-07-31T0409Z-intelevidenceregionssourcestechniquesbody

The earlier entry recorded Everest compromising a data-exchange platform Stadler Rail shares with a supplier, a CHF 10 million demand, and Stadler's refusal to pay. The extortion has now moved to its next stage: Everest has published the data (Inside IT Switzerland, 2026-07-30). What is new beyond that fact is a claim about who else is in the archive, and it needs handling with care.

TechNadu reports a 201 GB archive holding more than 271,000 files, attributing the figures to the actor itself via a threat-intelligence tracker that flagged the listing, with the content described as railway software, CCTV footage, engineering documentation and configuration files. It further reports that Everest claims the data touches projects linked to Deutsche Bahn, Merseytravel, Westbahn and MTR, and appends its own conditional, "if validated," exposure of engineering documentation and system configurations tied to these operators would raise downstream risk to connected railway infrastructure (TechNadu, 2026-07-29). That hedge is the correct reading. These are an extortion group's assertions about the value of what it stole, relayed through one outlet, and none of the four named operators has confirmed anything. TechNadu also notes the odd operational detail that Everest claimed the attack but did not list Stadler on its leak site, so the archive appears to have been dropped outside the group's normal publication channel.

Stadler's own position has not moved. Its media release, first published on 21 July and last revised on 23 July according to its content-management metadata, states that Stadler lost no data in the mid-July 2026 incident and that access to the specific technical data involved was obtained through compromised credentials for a data-exchange platform; it records the CHF 10 million demand, the refusal to pay, and a criminal complaint filed with the Thurgau cantonal police (Stadler Rail, 2026-07-21). The release does not confirm, deny or acknowledge the publication event, it predates it. So the current state is a victim statement scoped to "no security-relevant or personal data" standing beside an attacker claim of a 201 GB archive naming four third-party operators, with nothing yet reconciling them.

That gap is the pattern worth flagging rather than the file count. Two Swiss and European public-sector incidents this month followed the same arc, an early, narrow "not affected" characterisation, followed by a leak or an authority report that contradicted it. This one has not reached that point, and it may not; Stadler's statement may hold up entirely. But an early scoping statement issued before an attacker publishes is a hypothesis about what was taken, and it is being treated by readers as a finding.

incident22 Jul 04:34Zmulti-sourceOpen finding →
Sources: swissinfo.ch · Swiss IT Magazine · Halcyon · TechNadu · Stadler Rail · Inside IT Switzerland

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Threats1

Source distribution

  • halcyon.ai1 (17%)
  • inside-it.ch1 (17%)
  • itmagazine.ch1 (17%)
  • stadlerrail.com1 (17%)
  • swissinfo.ch1 (17%)
  • technadu.com1 (17%)
All cited sources (6)