Egregor

Egregor was a ransomware-as-a-service operation first observed in September 2020 and widely assessed as a successor to Maze, with substantial overlap in affiliates and strong technical similarities to Maze and Sekhmet. It rapidly became one of the most active big-game ransomware operations of late 2020, targeting large organizations across multiple regions and industries. Reported victims included enterprises in retail, transportation, staffing, technology, and gaming, and the operation was particularly associated with attacks on organizations in the United States. Egregor combined file encryption with pre-encryption data theft and public leak threats, making it a double-extortion actor. Affiliates commonly stole unencrypted corporate data before deploying the ransomware and used a public leak site to pressure victims that refused to negotiate or pay. The operation followed a revenue-sharing model in which affiliates received the majority of ransom proceeds and the core operators retained a smaller percentage. Egregor also used public shaming tactics and was notable for printing ransom notes through accessible printers on compromised networks, a relatively uncommon behavior among ransomware families. Intrusion chains associated with Egregor commonly began with initial access provided by other criminal malware ecosystems, especially QakBot/Qbot, and in some cases Zloader. Reporting also linked Egregor intrusions to phishing campaigns using malicious macro-enabled documents, with follow-on use of Cobalt Strike for reconnaissance, privilege escalation, lateral movement, and broader post-compromise activity. Operators and affiliates were observed using tools such as Advanced IP Scanner for internal reconnaissance and Rclone for data exfiltration. Egregor is associated with capabilities spanning initial access, reconnaissance, scanning, credential-enabled post-compromise operations, lateral movement, persistence, defense evasion, exfiltration, and extortion. The malware and its operators were reported to avoid some CIS and Eastern European language environments, consistent with patterns seen in other post-Soviet cybercrime operations. In February 2021, Ukrainian authorities, working with French and U.S. partners, conducted enforcement actions against individuals allegedly involved in Egregor operations and affiliate activity. The group’s leak site went offline around that time, indicating major disruption to the operation. Known aliases include Egregor ransomware gang and Egregor ransomware operation.