Morae listed on Everest ransomware leak site

• Ransomware group: Everest
• Country: United States
• Sector: Technology
• Announcement date: April 30, 2026

Everest ransomware group claims attack on Morae

The threat actor known as Everest has listed the technology company Morae on its leak site, claiming to have obtained data belonging to the organization. This announcement, made on April 30, 2026, marks a significant escalation in the group's targeting of specialized service providers. According to the group's claims, the organization must establish contact to prevent the public release of the stolen information.

The threat actor's modus operandi involves a process often referred to as double extortion. In these scenarios, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data prior to the encryption phase. The threat of leaking this stolen data on a public platform is used as leverage to pressure the victim into paying a ransom. If the target fails to comply with the attackers' demands, the stolen information is released to the public, often through dedicated leak sites used by ransomware groups to maximize visibility and pressure.

The group has stated that if the company does not establish contact, the data will be published. This tactic is designed to create maximum reputational and operational pressure on the victim organization.

Details of the alleged data theft

The announcement claims that 417 court-related files are currently held by the group. Based on available screenshots provided by the threat actor, the leak claim includes a specific set of legal documentation. The group alleges that the stolen information is highly sensitive, consisting of various documents used in legal proceedings.

The specific types of data allegedly involved in this breach include:

• Affidavits
• Writs
• Witness statements
• Subpoenas
• Statements of claim

While the specific file sizes and the exact nature of the data theft have not been disclosed by the group, the presence of these specific legal documents suggests a targeted interest in the organization's core business functions and client-related legal documentation.

About Morae

Morae is a global organization providing digital transformation, technology solutions, and consulting services for legal and compliance departments. The company specializes in providing software and strategic management support to optimize legal operations. Given its role in supporting legal and compliance departments, the organization handles a wide array of sensitive information related to legal workflows and strategic management.

Potential impact and organizational risks

This action by the Everest group may pose risks to the organization's operational continuity and data privacy. The allegedly leaked court documents may contain sensitive information regarding the company's legal proceedings and trade secrets. Because the company is based in the United States, this incident could lead to compliance issues under state laws and relevant data protection regulations.

Furthermore, there is a possibility that the leaked data could be utilized for identity theft or targeted phishing attacks. When sensitive legal documents such as affidavits or witness statements are exposed, they provide attackers with the necessary context to craft highly convincing social engineering campaigns. These campaigns can target employees, clients, or legal professionals by mimicking legitimate legal communications.

Given the group's history of data theft and extortion, the company may face potential secondary extortion attempts. Organizations in the technology and legal services sectors can mitigate such risks by implementing robust data loss prevention (DLP) strategies, maintaining strict access controls, and ensuring comprehensive encryption for data both at rest and in transit. Additionally, continuous monitoring of network traffic and regular security audits are essential for detecting unauthorized data exfiltration attempts before they result in a public leak.