Everest ransomware group lists Great Opportunity to monetize your corporate access on its leak site

• Ransomware group: Everest
• Announcement date: July 31, 2023

Everest ransomware group seeks new partners for network access collaboration

The Everest ransomware group has issued a public announcement on its leak site, targeting individuals or entities that possess access to corporate networks. Rather than announcing a specific breach or a victim, the group has released a recruitment notice aimed at establishing new business partnerships. This announcement, posted on July 31, 2023, serves as a call for collaboration to monetize corporate access through shared profits.

Details of the recruitment announcement

According to the notice published by the Everest group, they are actively looking for new partners who can provide access to corporate networks. The group's communication emphasizes a model of rapid operation and profit sharing with those who can deliver such access. The announcement specifies a timeframe for these applications, stating that the group will accept submissions until August 7.

To facilitate these potential partnerships, the group has provided various contact methods, including encrypted messaging services and email addresses. This approach allows potential collaborators to make direct contact with the group to discuss opportunities. This type of recruitment is a notable shift from typical ransomware announcements, which usually focus on the exposure of stolen data to pressure a victim into paying a ransom.

Data and victim information

The current listing does not contain any specific data leaks or information regarding a particular victim. The announcement does not include any details regarding the size of any data sets, the number of files involved, or any specific ransom demands. The listing names no data types.

Analysis and organizational implications

The recruitment efforts by the Everest group represent a significant strategic move that may facilitate various types of cyberattacks. By actively seeking partners with existing network access, the group may be attempting to streamline its operations for supply chain attacks or direct infiltration attempts against corporate networks. This method allows threat actors to bypass initial perimeter defenses by leveraging the access already obtained by a third party.

The Everest group has a documented history of engaging in data theft and extortion since 2020. Given this background, the current call for collaboration poses significant secondary risks to organizations. When threat actors can purchase or partner with individuals who already have a foothold in a network, the speed and effectiveness of an attack can increase dramatically. This collaboration model can lead to severe data breaches and significant legal consequences if corporate internal networks are successfully compromised through these partnerships.

To defend against these evolving threats, organizations should consider implementing proactive security measures. Strengthening identity and access management (IAM) is a critical step in preventing unauthorized users from maintaining access to internal systems. Organizations should also focus on monitoring for unusual network behavior and implementing strict controls over how third-party access is granted and audited. By adopting a zero-trust architecture, companies can reduce the potential impact of a compromised account or a malicious partner attempting to sell access to a threat actor.

General context on ransomware and extortion

Ransomware leak sites are platforms used by cybercriminal groups to host announcements, often involving double extortion tactics. In these scenarios, attackers not only encrypt a victim's data but also threaten to leak sensitive information if a ransom is not paid. The shift toward recruiting