Everest ransomware group lists Taekwang Network & Information as victim

Everest, a ransomware and data extortion group, has listed South Korean network integration and information security firm Taekwang Network & Information as a victim on its dark web leak site, according to Daily Secu.

The attackers claim to have stolen about 263.71GB of data across 54,581 files. Their description of the data includes internal business and financial documents, customer network build and operations materials, firewall and authentication system settings, maintenance records, some source code and personal information.

Daily Secu reviewed the 62 posts published by the attackers and identified 75 external organization, company, facility and brand names after removing duplicates and excluding Taekwang Network & Information itself. By sector, 24 were general companies, manufacturing, distribution and other businesses, 18 were telecom, IT and security, 10 were medical and health, 9 were public, research and public facilities, 7 were finance and fintech and 7 were education.

The article states that the data volume, file count and exposure have not been independently verified.

Earlier Everest activity

In a May 2026 trends report, AhnLab ASEC confirmed 26 victim postings in one month and counted Everest among the major active groups, having recorded 45 victim companies on the leak site in its 2024 analysis. In July 2026, AttackIQ analyzed an Everest ransomware executable and found functions that disrupt recovery and change firewall policies and system privileges before encryption, while Group-IB's March 2026 Asia-Pacific report recorded Everest as having posted Hyundai Elevator as a target.