Breaches

Everest Ransomware Group Claims 900GB Data Theft from Nissan

Zero Day Wire

— 2 min read
Everest Ransomware Group Claims 900GB Data Theft from Nissan

The Everest ransomware group has claimed responsibility for a significant cyber intrusion targeting Nissan Motor Co., Ltd., alleging the exfiltration of approximately 900GB of sensitive data from the Japanese automaker.

What We Know So Far

Everest posted alleged proof-of-compromise samples on underground forums, a tactic commonly associated with double-extortion ransomware operations. In these campaigns, threat actors steal data prior to encryption and threaten public disclosure if ransom demands are not met.

Security researchers at Hackmanac were the first to identify the alleged breach, issuing an early warning and indicating that Nissan’s manufacturing operations in Japan were the primary target. At this stage, the incident remains unconfirmed, and independent validation is ongoing.

Potential Data Exposure

While the contents of the stolen data have not been officially verified, the reported 900GB data volume suggests attackers may have obtained broad access to internal systems. Potentially impacted data could include:

  • Internal corporate documents
  • Engineering and manufacturing files
  • Customer information
  • Source code and development repositories

The full scope and sensitivity of the compromised data remain unclear.

Nissan’s Response

As of publication, Nissan has not issued an official statement regarding the alleged breach.

Everest’s Attack Methodology

The Everest group is known for exploiting exposed remote services, stolen VPN credentials, and phishing campaigns to gain initial access. Once inside a network, the group typically conducts extensive lateral movement, mapping infrastructure and prioritizing access to file servers, source code repositories, and backup systems.

Data exfiltration is often carried out using automated scripts, with stolen information staged and transferred over HTTPS connections or anonymized tunnels designed to blend in with legitimate outbound traffic.

Why This Matters

This incident would mark the second major cyber event linked to Nissan in recent years, underscoring the continued attractiveness of automotive manufacturers to cybercriminal groups. The sector remains a prime target due to its complex global supply chains, valuable intellectual property, and large volumes of customer and operational data.

Organizations across the automotive industry are strongly advised to reassess remote access controls, VPN security, and data loss prevention (DLP) strategies to reduce exposure to similar attacks.

Tags: Data Breach, Ransomware, Everest, Nissan, Automotive

Read more

ClickFix Campaign Compromises Legitimate Sites to Deploy MIMICRAT — A Custom C++ RAT With 22 Post-Exploitation Commands

ClickFix Campaign Compromises Legitimate Sites to Deploy MIMICRAT — A Custom C++ RAT With 22 Post-Exploitation Commands

Elastic Security Labs has disclosed a new ClickFix campaign that leverages compromised legitimate websites as delivery infrastructure to deploy a previously undocumented remote access trojan dubbed MIMICRAT (also tracked as AstarionRAT). The campaign, discovered earlier this month, demonstrates significant operational sophistication — from multi-stage PowerShell chains that bypass Windows security controls

By Zero Day Wire
ShinyHunters Linked to Device Code Vishing Attacks Targeting Microsoft Entra Accounts via OAuth 2.0 Abuse

ShinyHunters Linked to Device Code Vishing Attacks Targeting Microsoft Entra Accounts via OAuth 2.0 Abuse

A new wave of attacks is combining voice phishing (vishing) with OAuth 2.0 device authorization abuse to compromise Microsoft Entra accounts at technology, manufacturing, and financial organizations — bypassing traditional phishing infrastructure entirely. Sources told BleepingComputer they believe the ShinyHunters extortion gang is behind the campaigns, which the threat actors

By Zero Day Wire