- The Everest ransomware group just listed Citizens Bank on its dark web extortion portal. Though no threat, potential data release could affect millions of American customers.
- The group hit at least six organisations across finance, aviation, automotive, and retail sectors on April 20, 2026, alone, marking one of the most aggressive ransomware pushes of the year.
- A separate cybercrime forum listing reveals a new Malware-as-a-Service operation advertising custom ransomware, stealers, and command-and-control agents built specifically to compromise Windows enterprise environments.
The Everest ransomware group just added Citizens Bank to its growing list of victims, posting the Providence, Rhode Island-based institution on its dark web extortion portal on April 20, 2026.
The claim places one of the largest retail and commercial banks in the United States at the center of what cybersecurity analysts are describing as one of the most active ransomware campaigns of the year.
Citizens Bank serves millions of customers across the country through branches, ATMs, and digital platforms, offering personal banking, mortgages, loans, credit cards, and wealth management services. That scale makes the alleged breach particularly alarming for both customers and regulators.
Everest Posts Citizens Bank on Dark Web Extortion Portal
The listing on Everest’s leak site frames the incident as a data-related compromise, not simply a system encryption event. The post carries no stated ransom figure and includes no screenshots or sample data. Analysts note this pattern is consistent with early-stage extortion postings, where threat actors establish pressure before releasing proof to force a payout.
Everest is a well-documented ransomware-as-a-service (RaaS) operation with a track record of targeting large enterprises and critical infrastructure. The group runs a dark web leak site where it publishes victim names, countdown timers, and stolen data samples to maximise extortion pressure.
In recent weeks alone, the group claimed attacks on K Subsea Group, Nissan, and a Panamanian wind farm, a pattern analysts say signals the group is deliberately accelerating its operational pace heading into mid-2026.
Everest’s tactics are not limited to banks, a ransomware gang recently threatened to leak 80,000 Money Mart financial files on the dark web, demonstrating that financial services companies of all sizes, from major banks like Citizens to payday lenders like Money Mart, are prime targets for data extortion schemes that threaten to expose sensitive customer financial information.
Citizens Bank has issued no public statement at the time of publication, and independent verification of the full scope of the alleged breach remains unconfirmed.
Millions of Customers Face Exposure as Countdown Begins
Everest’s standard extortion model puts Citizens Bank customers in immediate danger. The group typically publishes a countdown timer and then releases stolen data publicly if the victim organisation refuses to pay. That released data usually includes personal identifiers, financial records, and account credentials (precisely the raw material that powers phishing campaigns and identity fraud at scale).
Cybersecurity experts advise Citizens Bank customers to monitor their accounts closely for unauthorized transactions and to place a fraud alert or credit freeze with major credit bureaus without delay.
Any unsolicited communication requesting account credentials, card details, or personal information, even if it appears to originate from Citizens Bank directly, should be treated with extreme suspicion and verified only through the bank’s official website or customer hotline.
New Malware-as-a-Service Listing Escalates Threat to Windows Enterprises
A separate development compounds an already alarming week in cybersecurity. A threat actor operating under the alias beac0x has surfaced on prominent cybercrime forums, advertising a sophisticated Malware-as-a-Service (MaaS) catalogue with a declared focus on Windows enterprise environments and advanced evasion tradecraft.
Beac0x claims more than five years of malware development experience and prior activity on established underground forums including ramp, xss, and exploit. Analysts note that credentialing claims of this specificity, when accurate, point to a technically proficient operator rather than an opportunistic newcomer.
The product catalogue on offer is extensive. Beac0x advertises private command-and-control (C2) agents, custom reflective loaders, stealer payloads, Beacon Object Files, shellcode and PE injectors, and fully functional Windows ransomware for both x64 and x86 architectures.
The actor built all tools in Rust (no_std) and C, with compatibility stretching from Windows XP through Windows 11 and current server editions, giving criminal buyers the widest possible deployment range across enterprise networks.
Beac0x also offers paid mentorship and workshops on Rust malware development, effectively lowering the technical barrier for less experienced criminal operators.
Threat intelligence analysts warn that listings of this depth and specificity, when genuine, represent “a meaningful capability uplift for the broader ransomware ecosystem,” translating directly into elevated risk for enterprise security teams already stretched thin by a relentless wave of extortion campaigns.
