Everest ransomware group lists data from Cabinet Remy Le Bonnois and Charlie Hebdo

• Ransomware group: Everest
• Country: France
• Sector: Professional Services
• Announcement date: November 13, 2021

The threat actor known as Everest has listed data allegedly belonging to Cabinet Remy Le Bonnois and Charlie Hebdo on its leak site. This announcement, made on November 13, 2021, indicates that the group is claiming ownership of information belonging to these two entities.

The details of the claim

The Everest group published a data leak announcement on November 13, 2021, targeting Cabinet Remy Le Bonnois and Charlie Hebdo. According to the post made by the threat actor, the data belonging to these specific entities is currently being offered for sale on their platform. This type of announcement is a common tactic used by ransomware groups to pressure organizations into paying ransoms by threatening to release sensitive information to the public or selling it to other malicious actors.

In this specific instance, the announcement was categorized as a data leak. While the group has made these claims, it is important to note that the announcement does not include a specific ransom demand. Furthermore, the group has not provided any specific details regarding the nature of the compromised data or the exact circumstances of the initial breach.

Data involved in the listing

Regarding the content of the alleged leak, the listing provides very limited information. No information regarding the nature of the leaked data has been provided by the threat actor. Furthermore, no screenshots or sample files have been shared to support the claim made by the group.

• The listing names no specific data types.

In many modern cyberattacks, threat actors utilize a strategy known as double extortion. In a double extortion scenario, the attackers do not just encrypt an organization's data to disrupt operations; they also exfiltrate sensitive information before the encryption occurs. The threat of leaking this stolen data on a public site serves as secondary leverage to force the victim to pay the ransom, even if the organization has robust backups to restore their systems.

Organization profiles

The entities named in the leak site announcement include Cabinet Remy Le Bonnois, which is an accounting and auditing firm based in Caen, France. This organization provides various professional services, including financial management, tax consulting, and accounting services to businesses.

Risk assessment and defensive considerations

This incident suggests a risk that sensitive information belonging to the organizations may have been compromised. The alleged data leak could lead to secondary risks such as identity theft or targeted phishing attacks against employees and clients of the affected entities. If the leaked data contains personal information, it may trigger legal obligations under data protection regulations such as the GDPR.

Given the past activities of the Everest group, it is possible that such announcements are part of a double-extortion strategy. When organizations face such threats, it is critical for them to review their data security measures and notify the affected parties to mitigate potential harm. General defensive steps for organizations in the professional services sector often include implementing strict access controls, maintaining comprehensive logging, and ensuring that data encryption is applied both at rest and in transit. Additionally, regular security audits and employee training regarding phishing can help reduce the likelihood of successful initial access by threat actors.