Crimsgroup Data leak claimed by Everest ransomware group

• Ransomware group: Everest
• Country: United States
• Sector: Technology
• Announcement date: April 2, 2024

Everest claims data leak involving Crimsgroup

The threat actor known as Everest has published a data leak announcement on their leak site, claiming to have exfiltrated a significant amount of information. According to the announcement, the stolen data is allegedly associated with Crimsgroup. This development follows a pattern of activity observed from the group, which has been active since 2020 and is known for data exfiltration, extortion, and the sale of access to various organizations.

The announcement was made on April 2, 2024, with the group claiming the attack occurred on the same date. This type of public shaming is a common tactic used by ransomware groups to pressure victims into paying ransoms, a method often referred to as double extortion. In such scenarios, attackers do not just encrypt a victim's systems but also steal sensitive data to threaten its public release if demands are not met.

Details of the alleged breach

The Everest group has claimed to have made 263 GB of data available for download. The group asserts that this data is linked to several specific domains. According to the leak site post, the domains involved in this alleged breach include:

• crimsonenginc.com
• whitetailautomation.com
• scadahive.com
• herbert.com

The group has reportedly provided access to this data through external file-sharing links. Despite the significant volume of data claimed, the announcement did not provide specific details regarding the nature or the exact content of the leaked files. The listing names no specific data types, providing only the total size of the alleged breach.

About Crimson Engineering

The organization identified in the claim, Crimson Engineering, is a technology company. The company specializes in providing industrial automation, control systems, and engineering solutions. Their expertise is particularly focused on SCADA systems and automation infrastructure, serving critical sectors such as energy and manufacturing.

Potential impact and security considerations

This alleged leak may have significant consequences for the involved entities, potentially impacting their operational continuity and commercial reputation. Because the organization is based in the United States, any confirmed data breaches may fall under the scope of federal regulations and state-level privacy laws.

The exposure of corporate secrets or customer data, should the claims be verified, could lead to various secondary risks. These include targeted phishing attacks and identity theft attempts. For organizations operating in the technology and industrial automation sectors, maintaining robust security postures is critical to defending against such threats.

Common defensive strategies for organizations include implementing strict access controls, maintaining regular offline backups, and conducting comprehensive employee training to recognize social engineering attempts. Furthermore, monitoring for unauthorized data exfiltration and ensuring that critical infrastructure, such as SCADA systems, is properly segmented from general business networks are vital steps in mitigating the risk of such attacks. Given the history of the Everest group, these types of announcements are often part of a broader extortion strategy designed to maximize pressure on the victim.