Everest Ransomware Gang’s Leak Website Gets Hacked
Published on April 8, 2025
- The leak site of the Everest Ransomware gang was defaced over the weekend.
- It displayed a ludic message condoning crime and mentioning Prague.
- For now, it is not clear who did this and whether the incident is legitimate.
The Everest ransomware gang, a notorious cybercriminal group linked to a series of high-profile hacks since 2020, has had its dark web leak site compromised over the weekend, with no indication of who might be behind it besides the reference to Prague.
This hub for publishing stolen files and extorting victims into paying ransoms was defaced with a provocative message that simply read, “Don’t do crime CRIME IS BAD xoxo from Prague.”
The site remained in this hacked state as of April 7. It remains unclear whether the attackers behind this act also accessed or leaked sensitive data stored by Everest on the site.
Known for its global footprint of operations, Everest is a Russia-linked ransomware gang responsible for numerous data breaches targeting enterprises and government organizations.
These include a significant breach of NASA, an attack on the Brazilian government, and the theft of over 420,000 customer records from the cannabis retailer Stiiizy. U.S. authorities have previously attributed multiple attacks to Everest, underscoring its operational scale and complexity.
The hacking of a ransomware gang itself is not unprecedented but continues to be a curious twist in the ongoing digital battles between criminals, researchers, and occasionally opposing cyber groups.
While the perpetrators of this attack on Everest remain unknown, the defacement aims to undermine the gang's authority and ability to intimidate its victims. Embarrassing them publicly could erode trust among the gang’s criminal associates and potential victims.
The act of hacking a ransomware gang’s infrastructure may also serve as a warning. Over the past few years, several ransomware groups have faced similar sabotage or internal leaks, such as the major exposure of Black Basta’s chat logs in February 2025.
Everest remains operational, but this incident raises questions about the cybersecurity posture of even the cybercriminals themselves. While Everest's leak site may be temporarily compromised, it’s clear the fight against ransomware continues to evolve on multiple fronts.
Related
Most Popular
Most Popular