1. Executive summary
The Everest ransomware group listed Lindauer Dornier GmbH, a German mechanical engineering firm based in Lindau, on its leak site on 2026-10-21. The listing names the victim and country (DE) and carries no published sample data, no stated ransom demand and no claimed exfiltration volume in the indexed record. No CVE is associated with this item, no exploitation state is recorded in CISA KEV, and no MITRE ATT&CK profile exists for Everest, so the attribution to that group rests on the leak-site listing alone and is unconfirmed. For EMEA financial services the direct exposure is third-party: Lindauer Dornier is an industrial manufacturer, not a regulated financial entity, and the risk to clients runs through supplier and counterparty relationships rather than through any financial-sector system named here. The absence of technical detail means this advisory supports supplier-risk triage, not technical containment.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 28 | A named ICT third-party (Lindauer Dornier) is reported compromised via a ransomware leak-site listing, and clients may hold it as a supplier or in their supply chain | Clients must determine whether the firm is an ICT third-party provider in their register and apply the general principles for third-party risk, including contractual and monitoring obligations |
| NIS2 Art. 21(2)(d) | The compromise is reported against a supplier in the manufacturing supply chain, engaging supply chain security measures for in-scope entities | In-scope entities must assess supply chain exposure to this supplier and record the security measures applied to it |
No DORA incident-reporting article is engaged on the facts available: the listing gives no indication that a client's own ICT systems are affected, and no major-incident classification can be made from a leak-site post alone.
3. Technical analysis & attack chain
The public record for this item contains no confirmed attack chain. What is confirmed is narrow: the Everest group posted Lindauer Dornier to its leak site on 2026-10-21, tagged the victim as German, and the indexed page carries a leak screenshot placeholder but no published files, no sample records and no stated demand. Ransomware.live indexes only publicly visible operator posts and states it does not access or hold the underlying stolen content.
Because no initial-access vector, exploited component, CVE, payload, persistence mechanism, command-and-control channel or exfiltration detail appears in the source, none can be described here. The absence of a CVE and of any CISA KEV entry is consistent with a leak-site listing that makes no technical claim; it does not establish that no vulnerability was used.
The attribution to Everest is unconfirmed. There is no MITRE ATT&CK profile for the group in the available data, and the only basis for naming it is the operator's own leak-site post, which is a single source and self-asserted. Treat the group name as the operator's claim, not a corroborated finding. The victim description on the page is marked as AI generated and should not be relied on as company data.
For a financial-services reader the practical question is not the manufacturer's internal compromise but whether any client relationship, shared service or data flow touches this supplier. Nothing in the source establishes such a link; it must be checked against the client's own third-party register.
4. Mitigation & containment
P1 (within 24h): confirm whether Lindauer Dornier appears in the third-party or supplier register, and if so which business services, data flows or contracts depend on it. Where a dependency exists, contact the supplier through the account or procurement owner to establish whether the listing is acknowledged and whether any client data is in scope. Do not treat the leak-site post as proof of data loss; it is an unverified operator claim.
P2 (within 72h): for any confirmed dependency, review the contract against DORA Art. 30 key contractual provisions, specifically breach notification, audit and data-return terms, and record the outcome. Restrict any interactive supplier access (VPN, remote support, file transfer) to named accounts with logging until the supplier's status is clear.
P3 (within 7 days): update the third-party risk assessment for this supplier with the listing date and the unconfirmed status, and set a review date. If the supplier later publishes a breach notice, re-run the assessment against DORA Art. 28 and NIS2 Art. 21(2)(d) supply chain measures.
No technical containment (blocking, isolation, patching) applies to a client's own estate on these facts, because the source names no client system, indicator or exploited component.
5. Indicators of compromise
No indicators of compromise available in the source material. The leak-site listing provides no hashes, domains, IP addresses, file paths or other atomic indicators, and none are fabricated here.
The only observable is behavioural: the appearance of Lindauer Dornier on the Everest leak site on 2026-10-21. That is a single-source, operator-asserted event and should be verified against the supplier directly before any action beyond the triage in §4.
6. Detection
Insufficient indicators to author detection rules. The source contains no distinctive strings, command-line flags, file names, registry keys, ransom-note text or network artefacts from which a YARA or Sigma rule could be built. A rule keyed on the group or victim name would detect reporting about the event, not the threat, and is not emitted.
7. Sources
- Ransomware.live, "Victim: Lindauer Dornier – everest", https://www.ransomware.live/id/TGluZGF1ZXIgRG9ybmllckBldmVyZXN0, published 2026-10-21.
This is a single source. The group attribution, victim identity and country tag all rest on this one leak-site index entry and are unconfirmed.
8. Adverse Trace position
Adverse Trace assesses this as a low-severity item for EMEA financial services clients: it is a leak-site listing against a non-financial industrial manufacturer, with no CVE, no CISA KEV exploitation state, no published data and no corroborated attribution to Everest beyond the operator's own post. The risk is confined to clients that hold Lindauer Dornier as a supplier or counterparty, and even there the exposure is unproven until the supplier confirms or denies the claim. We will monitor the leak site for publication of files or a stated demand, watch for any supplier breach notice, and re-issue this advisory if corroborated technical detail or a confirmed data-loss claim emerges. Clients with a supplier relationship should complete the P1 register check in §4 and report the outcome to their third-party risk function.
Published via PulseTrace — Adverse Trace threat intelligence.