Ransomware Alert: Everest Group Hits Umiles, Frost Bank, and Citizens Bank in April 20 Wave

Everest ransomware attack claims put remote access in focus

The cybersecurity landscape has reached a new peak this month. The Everest ransomware group, a Russian-speaking collective active since 2020, has accelerated its operations in April 2026, hitting the banking and logistics sectors simultaneously.

Known for its dual role as a Ransomware-as-a-Service (RaaS) provider and an Initial Access Broker (IAB), Everest doesn’t just encrypt data; it recruits insiders and sells access to breached networks to other high-level threat actors. For the modern enterprise, an Everest infection is rarely a solo event—it is the opening of a backdoor for the entire criminal ecosystem.

Technical Breakdown: The Credential Path

The Everest strategy focuses heavily on the Remote Access layer, exploiting the “trust” built into hybrid work environments.

1. Initial Entry: Exploiting the Perimeter

Everest frequently gains entry through brute-force attacks on Remote Desktop Protocol (RDP) services or by exploiting unpatched vulnerabilities in enterprise VPN clients. They often purchase legitimate credentials from the dark web or recruit disgruntled insiders to facilitate the initial intrusion.

2. Session Theft: Bypassing MFA

A defining tactic of Everest’s recent wave is the use of infostealers to siphon session cookies. By stealing an active cookie, the attacker can hijack a logged-in session, effectively bypassing Multi-Factor Authentication (MFA) because the system believes the user has already successfully signed in.

3. Encryption & Double Extortion

Once inside, the group uses penetration frameworks like Cobalt Strike to move laterally. They follow a “double extortion” model: they exfiltrate sensitive data before triggering encryption. Even if an organization has reliable backups and can restore its systems, Everest uses the threat of a public data leak to maintain high financial and operational pressure.

How to Protect & Mitigate

Defending against an actor that buys and sells access requires more than just a firewall; it requires identity discipline.

• Identity Hygiene: Force global password resets if an intrusion is suspected. Move beyond simple SMS-based MFA to Phishing-Resistant MFA (FIDO2) to ensure that stolen credentials cannot be used without a physical hardware key.
• Network Hardening: Close all exposed RDP ports and transition to a Zero Trust Network Access (ZTNA) model where internal resources are hidden from the public web.
• Offline Data Backups: Maintain immutable, offline backups. Everest specifically targets online backup solutions to delete shadow copies and prevent restoration, making off-site, air-gapped storage essential for recovery.

Hexnode’s Role: The Converged “Security Brain”

The Everest threat pattern highlights a larger reality: passwords and perimeter-based access controls are no longer enough. Modern attacks succeed by exploiting the gaps between identity, device trust, browser activity, and endpoint visibility. Reducing that risk requires a more connected approach.

Pillar 1: Device Trust and Governance (Hexnode UEM + IdP)

Hexnode UEM, when used alongside identity providers and conditional access integrations, enables organizations to enforce device-aware access controls. Sensitive internal applications, financial systems, and administrative portals can be restricted to devices that are managed, verified, and compliant with policy.

This reduces the practical value of stolen credentials. Even if an attacker obtains a valid username and password, access can be denied when the login attempt originates from an unmanaged, non-compliant, or otherwise untrusted endpoint.

Pillar 2: Behavioral Detection and Response (Hexnode XDR)

Everest and similar groups often rely on trusted tools to carry out malicious actions, which makes signature-only detection less effective. Hexnode’s endpoint visibility and detection capabilities help security teams identify suspicious behavioral patterns, investigate abnormal activity, and take action faster.

When unusual endpoint behavior is detected, organizations can contain risk by restricting access, isolating affected devices from corporate resources, and accelerating incident response before the threat spreads further or data is exfiltrated.

Implementing Zero Trust Access: The Hexnode and Okta Integration Guide

Pillar 3: Browser and Endpoint Controls

Browser-driven threats remain a common path for phishing, credential theft, and session abuse. Hexnode allows organizations to enforce managed browser policies and apply consistent endpoint controls across user devices.

By restricting unauthorized extensions, applying secure browser configurations, and controlling risky user behaviors, organizations can reduce exposure from one of the most common attack surfaces in the enterprise.

Featured Resource

Introduction to Hexnode XDR

Discover how Hexnode XDR detects, investigates, and responds to modern endpoint threats in real time.

Download XDR Guide

Pillar 4: Zero Trust Access Strategy

A strong defense also depends on reducing unnecessary exposure. By aligning device posture, identity verification, and access policy with a broader Zero Trust or ZTNA strategy, organizations can move away from open network-based trust models.

Instead of making internal applications broadly reachable, access is granted only to verified users on trusted devices under defined conditions. This significantly lowers the likelihood of unauthorized discovery, abuse, and lateral movement.

Closing the Gaps Attackers Exploit

Groups like Everest are effective because they take advantage of disconnected security controls and operational blind spots. Closing those gaps requires visibility across devices, enforcement tied to identity, and access decisions based on trust rather than location alone.

By combining device management, identity-aware access, browser controls, and endpoint visibility, Hexnode helps organizations reduce risk, improve response readiness, and maintain stronger control against modern ransomware threats.