Security Alert: Everest Group Targeting Critical Infrastructure

Summary:

‍Everest is a financially motivated, Russian-speaking group engaged in data theft, extortion, and initial access brokering. It is actively attacking critical infrastructure, and the period from July through October 2025 represents the group’s most active months since its inception in 2020.

Details:

• Targets: Recent attack and data theft claims include major energy, aviation, and telecommunications sector targets in Sweden, Ireland, Saudi Arabia, and the US.
• Tactics: Everest exploits vulnerable remote services and uses stolen or insider-provided credentials to breach supplier-managed file-transfer systems, steal sensitive data, and extort victims.

Mitigation:

• Enforce multi-factor authentication for all remote, vendor, and privileged accounts used to access IT and OT networks. Continuously monitor for abnormal login patterns or access attempts outside standard maintenance windows [M1032].
• Restrict direct internet exposure of vendor and file-transfer systems connected to energy operations. Use hardened reverse proxies, network segmentation, and strict authentication for external maintenance or data exchange [M1030].
• Apply least-privilege access for all third-party contractors and integrators. Segment supplier and maintenance networks from production and SCADA environments to prevent lateral movement [M1036].
• Monitor for credential misuse, command-and-control traffic, large outbound data transfers, and staging activity from engineering or file-transfer servers. Correlate with baseline operational telemetry to detect anomalies in OT-connected systems [M1047].
• Maintain and harden offline backups of both IT and OT system configurations to enable recovery and reduce extortion leverage. Ensure backup infrastructure is isolated from control networks and tested regularly for restoration [M1053].
• Identify and remediate known exploited vulnerabilities, such as Fortinet edge device flaws CVE-2024-21762 and CVE-2024-55591, which have been leveraged by other ransomware groups against infrastructure operators [M1051].
• Deploy dedicated anti-ransomware defenses across IT and OT boundary networks to block malicious binaries pre-execution [M1038], detect runtime behaviors and data exfiltration attempts [M1040], prevent tampering and network intrusion [M1031], and protect the integrity of offline backups to ensure operational recovery [M1053].

References:

• Sweden’s Power Grid Operator Confirms Data Breach Claimed by Ransomware Gang
• Dublin Airport Under Fire After Devastating Attack on European Airports
• HHS Threat Actor Profile: Everest Ransomware Group (PDF)
• Everest Offers Corporate Insiders Cash for Remote Access

Source Summary:

This Alert is based on Halcyon observations, open-source information, and ongoing research. Findings reflect our current understanding of threat actor activity and may be updated as new evidence emerges.

‍