DBHunter
Infinity Member
Golden Member
- Joined
- August 23, 2025
- Messages
- 2,358
- Reaction score
- 5,316
- Points
- 113
- Thread Author
- #1
Hello DNA.
So today, I am uploading the complete Everest Group data extraction from Umiles Group (umilesgroup.com) – Spain's premier drone technology and urban air mobility company[reference:0]. Over 147GB of uncompressed corporate intelligence, internal communications, employee records, and sensitive flight operations data.
What we hit:
- Unpatched VPN appliance with leaked credentials from an infostealer log
- Stolen session cookie bypassed MFA on their corporate domain[reference:1]
- Lateral movement via Cobalt Strike to their document management system
- Zero segmentation between their ERP and engineering repositories[reference:2]
Database Info:
- Platform: Corporate Network / NAS + ERP (unknown backend)
- Organization: Umiles Group
- Domain: umilesgroup.com
- Country: Spain
- Total Leak Size: ~380 GB raw (including multiple victims), Umiles portion compressed to 147GB .rar[reference:3]
- Ransomware Group: EVEREST
- Date of Attack: April 20, 2026[reference:4]
- Published Statement: "The full leak will be published soon, unless a company representative contacts us via the channels provided."[reference:5]
Compromised Data – Umiles Group Portion:
- Employee personal data (national ID card scans – DNI, passports, medical certificates, pilot licenses)[reference:6]
- Corporate email archives (.pst files) of key executives and engineering leads[reference:7]
- Screen recordings of operational workflows and internal engineering meetings[reference:8]
- Aviation maintenance records, drone logbooks, and engine borescope inspection videos[reference:9]
- Customer databases (commercial drone buyers, government contracts, logistics partners)[reference:10]
- Non-disclosure agreements (NDAs) and commercial purchase agreements[reference:11]
- Flight risk assessments, training programs for law enforcement, and regulatory submissions to European civil aviation agencies[reference:12]
- Payroll data and employment contracts
- Confidential presentations and product roadmaps
Sample Data (redacted – representative intelligence):
Quote:
- Employee Record: DNI scan (Spanish national ID) – [NAME REDACTED] – Passport number, expiration, issuing authority.
- Email Thread (Engineering): Subject: "Drone formation control algorithm update" – Attachments: Source code snippets, internal API keys.
- Flight Log: Date: 2025-03-12 – Duration: 00:14:23 – Mission: "Industrial inspection – Repsol refinery" – Pilot: [NAME REDACTED] – GPS coordinates included.
- NDA: Between Umiles Group and [REDACTED GOVERNMENT ENTITY] – Effective Date: 2024-11-01 – Governing Law: Spain.
- Financial Document: Budget Q3 2026 – R&D allocation: €1.2M – Marketing spend: €450k.
Additional intelligence:
- The company publicly claimed the breach only affected "low-sensitivity data from 2019"[reference:13]. The archive says otherwise. Internal documents, employee DNI scans, and commercial agreements from 2025 and 2026 are included.
- Everest is a Russian-speaking RaaS provider and initial access broker[reference:14]. They recruit insiders and cross-sell network access to other threat actors[reference:15].
- The group's "double extortion" model means files were exfiltrated BEFORE encryption was triggered[reference:16]. Backups do not matter. The data is already out.
- The leaked files contain personally identifiable information (PII) of at least 100+ employees, including full addresses and national ID numbers.
Deliverables:
- `umiles_group_full_leak.rar` – 147GB compressed archive
- Folder structure retained:
- `/employee_data/dni_scans/` – +50 files
- `/email_archives/executives/` – .pst files
- `/flight_logs/` – 2024–2026
- `/contracts/nda/` – 20+ agreements
- `/financial/budgets/` – internal strategy docs
Download:
So today, I am uploading the complete Everest Group data extraction from Umiles Group (umilesgroup.com) – Spain's premier drone technology and urban air mobility company[reference:0]. Over 147GB of uncompressed corporate intelligence, internal communications, employee records, and sensitive flight operations data.
What we hit:
- Unpatched VPN appliance with leaked credentials from an infostealer log
- Stolen session cookie bypassed MFA on their corporate domain[reference:1]
- Lateral movement via Cobalt Strike to their document management system
- Zero segmentation between their ERP and engineering repositories[reference:2]
Database Info:
- Platform: Corporate Network / NAS + ERP (unknown backend)
- Organization: Umiles Group
- Domain: umilesgroup.com
- Country: Spain
- Total Leak Size: ~380 GB raw (including multiple victims), Umiles portion compressed to 147GB .rar[reference:3]
- Ransomware Group: EVEREST
- Date of Attack: April 20, 2026[reference:4]
- Published Statement: "The full leak will be published soon, unless a company representative contacts us via the channels provided."[reference:5]
Compromised Data – Umiles Group Portion:
- Employee personal data (national ID card scans – DNI, passports, medical certificates, pilot licenses)[reference:6]
- Corporate email archives (.pst files) of key executives and engineering leads[reference:7]
- Screen recordings of operational workflows and internal engineering meetings[reference:8]
- Aviation maintenance records, drone logbooks, and engine borescope inspection videos[reference:9]
- Customer databases (commercial drone buyers, government contracts, logistics partners)[reference:10]
- Non-disclosure agreements (NDAs) and commercial purchase agreements[reference:11]
- Flight risk assessments, training programs for law enforcement, and regulatory submissions to European civil aviation agencies[reference:12]
- Payroll data and employment contracts
- Confidential presentations and product roadmaps
Sample Data (redacted – representative intelligence):
Quote:
- Employee Record: DNI scan (Spanish national ID) – [NAME REDACTED] – Passport number, expiration, issuing authority.
- Email Thread (Engineering): Subject: "Drone formation control algorithm update" – Attachments: Source code snippets, internal API keys.
- Flight Log: Date: 2025-03-12 – Duration: 00:14:23 – Mission: "Industrial inspection – Repsol refinery" – Pilot: [NAME REDACTED] – GPS coordinates included.
- NDA: Between Umiles Group and [REDACTED GOVERNMENT ENTITY] – Effective Date: 2024-11-01 – Governing Law: Spain.
- Financial Document: Budget Q3 2026 – R&D allocation: €1.2M – Marketing spend: €450k.
Additional intelligence:
- The company publicly claimed the breach only affected "low-sensitivity data from 2019"[reference:13]. The archive says otherwise. Internal documents, employee DNI scans, and commercial agreements from 2025 and 2026 are included.
- Everest is a Russian-speaking RaaS provider and initial access broker[reference:14]. They recruit insiders and cross-sell network access to other threat actors[reference:15].
- The group's "double extortion" model means files were exfiltrated BEFORE encryption was triggered[reference:16]. Backups do not matter. The data is already out.
- The leaked files contain personally identifiable information (PII) of at least 100+ employees, including full addresses and national ID numbers.
Deliverables:
- `umiles_group_full_leak.rar` – 147GB compressed archive
- Folder structure retained:
- `/employee_data/dni_scans/` – +50 files
- `/email_archives/executives/` – .pst files
- `/flight_logs/` – 2024–2026
- `/contracts/nda/` – 20+ agreements
- `/financial/budgets/` – internal strategy docs
Download:
