Loading malware…
Egregor is a Windows ransomware family and ransomware-as-a-service operation that emerged in September 2020 and is widely associated with the post-Maze criminal ecosystem. It has been described as a successor or rebrand linked to Maze, with overlap in affiliates, extortion practices, ransom-note language, and cryptographic implementation. Egregor encrypts victim files, appends randomized extensions, and has been associated with ChaCha8-based file encryption. It also conducts double extortion by stealing data prior to encryption and threatening public release of stolen information if victims do not pay.
Operationally, Egregor has been observed in enterprise intrusions following access provided by QBot/QakBot distributors, including partnerships also noted with ProLock. It has used Cobalt Strike-created services and encoded PowerShell commands for lateral movement, abused regsvr32 to execute malicious DLLs, and employed DLL side-loading to launch payloads. Reported behaviors also include use of Windows API calls to hinder detection, decryption or unpacking before execution, querying local or system time, and gathering information about users on compromised systems.
Egregor targeted corporate networks and high-profile organizations across multiple sectors, including transportation, retail, gaming, staffing, and other large enterprises. The operation became notable for an uncommon intimidation tactic: sending ransom notes to accessible printers within victim environments. Like Maze and Sekhmet, Egregor has been included in public decryptor support after release of master decryption keys, and decryption workflows for some cases have required the original ransom note. Law-enforcement action has targeted individuals believed to be involved in Egregor operations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
15 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The Windows Background Intelligent Transfer Service (BITS) is vulnerable to a privilege elevation vulnerability if it improperly handles symbolic links... The exploit was used in Maze and Egregor ransomware campaigns. | The exploit was used in Maze and Egregor ransomware campaigns.
There have been limited and uncorroborated reports of Egregor utilizing CVE-2020-0688 (a remote code execution flaw in Microsoft Exchange). | Egregor ransomware is an offshoot of the Sekhmet malware family that has been active since mid-September 2020. The ransomware operates by compromising organizations, stealing sensitive user data, encrypting said data, and demanding a ransom to exchange encrypted documents.
Some sources also report the possible exploitation of CVE-2018-8174 (VBScript Engine), CVE-2018-4878 (Adobe Flash Player) & CVE-2018-15982 (Adobe Flash Player). | Egregor ransomware is an offshoot of the Sekhmet malware family that has been active since mid-September 2020. The ransomware operates by compromising organizations, stealing sensitive user data, encrypting said data, and demanding a ransom to exchange encrypted documents.
Some sources also report the possible exploitation of CVE-2018-8174 (VBScript Engine), CVE-2018-4878 (Adobe Flash Player) & CVE-2018-15982 (Adobe Flash Player). | Egregor ransomware is an offshoot of the Sekhmet malware family that has been active since mid-September 2020. The ransomware operates by compromising organizations, stealing sensitive user data, encrypting said data, and demanding a ransom to exchange encrypted documents.
A threat actor involved in the attack confirmed that they gained initial access to at least one compromised network via the CVE-2019-11510. Exploiting the CVE-2019-11510 A vulnerability in Pulse Secure VPN servers, tracked as CVE-2019-11510, is one of the most popular flaws exploited by ransomware gangs to deploy encrypting malware. | The Egregor ransomware gang, which emerged in September 2020 as a possible successor to Sekhmet, claimed responsibility for the attack on its blog.
Some sources also report the possible exploitation of CVE-2018-8174 (VBScript Engine), CVE-2018-4878 (Adobe Flash Player) & CVE-2018-15982 (Adobe Flash Player). | Egregor ransomware is an offshoot of the Sekhmet malware family that has been active since mid-September 2020. The ransomware operates by compromising organizations, stealing sensitive user data, encrypting said data, and demanding a ransom to exchange encrypted documents.
Prioritize patching of public-facing remote access products and applications, including recent RDP vulnerabilities (CVE-2020-0609, CVE-2020-0610, CVE-2020-16896, CVE-2019-1489, CVE-2019-1225, CVE-2019-1224, CVE-2019-1108). | The FBI first observed Egregor ransomware in September 2020. To date, the threat actors behind this ransomware variant claim to have compromised over 150 victims worldwide. Once a victim company’s network is compromised, Egregor actors exfiltrate data and encrypt files on the network.
Prioritize patching of public-facing remote access products and applications, including recent RDP vulnerabilities (CVE-2020-0609, CVE-2020-0610, CVE-2020-16896, CVE-2019-1489, CVE-2019-1225, CVE-2019-1224, CVE-2019-1108). | The FBI first observed Egregor ransomware in September 2020. To date, the threat actors behind this ransomware variant claim to have compromised over 150 victims worldwide. Once a victim company’s network is compromised, Egregor actors exfiltrate data and encrypt files on the network.
Prioritize patching of public-facing remote access products and applications, including recent RDP vulnerabilities (CVE-2020-0609, CVE-2020-0610, CVE-2020-16896, CVE-2019-1489, CVE-2019-1225, CVE-2019-1224, CVE-2019-1108). | The FBI first observed Egregor ransomware in September 2020. To date, the threat actors behind this ransomware variant claim to have compromised over 150 victims worldwide. Once a victim company’s network is compromised, Egregor actors exfiltrate data and encrypt files on the network.
Prioritize patching of public-facing remote access products and applications, including recent RDP vulnerabilities (CVE-2020-0609, CVE-2020-0610, CVE-2020-16896, CVE-2019-1489, CVE-2019-1225, CVE-2019-1224, CVE-2019-1108). | The FBI first observed Egregor ransomware in September 2020. To date, the threat actors behind this ransomware variant claim to have compromised over 150 victims worldwide. Once a victim company’s network is compromised, Egregor actors exfiltrate data and encrypt files on the network.
Prioritize patching of public-facing remote access products and applications, including recent RDP vulnerabilities (CVE-2020-0609, CVE-2020-0610, CVE-2020-16896, CVE-2019-1489, CVE-2019-1225, CVE-2019-1224, CVE-2019-1108). | The FBI first observed Egregor ransomware in September 2020. To date, the threat actors behind this ransomware variant claim to have compromised over 150 victims worldwide. Once a victim company’s network is compromised, Egregor actors exfiltrate data and encrypt files on the network.
Prioritize patching of public-facing remote access products and applications, including recent RDP vulnerabilities (CVE-2020-0609, CVE-2020-0610, CVE-2020-16896, CVE-2019-1489, CVE-2019-1225, CVE-2019-1224, CVE-2019-1108). | The FBI first observed Egregor ransomware in September 2020. To date, the threat actors behind this ransomware variant claim to have compromised over 150 victims worldwide. Once a victim company’s network is compromised, Egregor actors exfiltrate data and encrypt files on the network.
Prioritize patching of public-facing remote access products and applications, including recent RDP vulnerabilities (CVE-2020-0609, CVE-2020-0610, CVE-2020-16896, CVE-2019-1489, CVE-2019-1225, CVE-2019-1224, CVE-2019-1108). | The FBI first observed Egregor ransomware in September 2020. To date, the threat actors behind this ransomware variant claim to have compromised over 150 victims worldwide. Once a victim company’s network is compromised, Egregor actors exfiltrate data and encrypt files on the network.
Researchers noticed a recent trend in which Prophet Spider uses CVE-2020-14882 and CVE-2020-14750 to get a foothold into target environments. Both CVEs relate to path traversal vulnerabilities that enable an attacker to access the WebLogic administrative console, which then allows for unauthenticated remote code execution.
Researchers noticed a recent trend in which Prophet Spider uses CVE-2020-14882 and CVE-2020-14750 to get a foothold into target environments. Both CVEs relate to path traversal vulnerabilities that enable an attacker to access the WebLogic administrative console, which then allows for unauthenticated remote code execution.
11 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Depuis la mi-septembre 2020, l’ANSSI constate une vaste campagne d’attaques informatiques menées à l’aide du rançongiciel Egregor.
Depuis la mi-septembre 2020, l’ANSSI constate une vaste campagne d’attaques informatiques menées à l’aide du rançongiciel Egregor.
In October 2020, video game developer Crytek was victim to an Egregor ransomware attack, which subsequently also reportedly affected Ubisoft.
DEV-0216 ... has operated as an affiliate for Egregor, Maze, Lockbit, REvil, and Conti in numerous high-impact incidents.
Between June 2020 and March 2021, Lockean attacked at least seven more companies with various ransomware families: Maze, Egregor, ProLock, REvil.
Between June 2020 and March 2021, Lockean attacked at least seven more companies with various ransomware families: Maze, Egregor, ProLock, REvil.
37 distinct techniques documented for this family, organized by ATT&CK tactic.
– T1047 : Windows Management Instrumentation - Utilisation du Windows Management Instrumentation [16].
Later in the attack chain, operators use Cobalt Strike to gather information, escalate privileges, move laterally across the network and prepare the system for encryption.
AppleSeed has the ability to execute its payload via PowerShell... APT19 used PowerShell commands to execute payloads... APT28 downloads and executes PowerShell scripts and performs PowerShell commands... Start-Process / Invoke-Command / System.Management.Automation
Many entries mention .bat, .cmd, or batch scripting, such as APT1 using batch scripting to automate execution, APT41 using a batch file for persistence, and numerous malware families executing or downloading batch files. | The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.
The Windows Background Intelligent Transfer Service (BITS) is vulnerable to a privilege elevation vulnerability... An actor can exploit this vulnerability to execute arbitrary code with system-level privileges.
Frankenstein has used PowerShell to run a series of base64-encoded commands, that acted as a stager and enumerated hosts.
– T1078 : Valid Accounts - Utilisation d’identifiants légitimes obtenus préalablement [11].
The content is a long ATT&CK-style listing of malware and threat groups that 'decrypt', 'decode', 'deobfuscate', 'unpack', or 'decompress' payloads, strings, configuration data, shellcode, and files prior to execution or use.
AppleSeed can call regsvr32.exe for execution. APT19 used Regsvr32 to bypass application control techniques. APT32 created a Scheduled Task/Job that used regsvr32.exe to execute a COM scriptlet that dynamically downloaded a backdoor and injected it into memory.
It then uses BITS to download the Egregor DLL from a malicious server and execute the payload using Rundll32.
The content includes environment-aware checks such as "Bazar can also check if the Russian language is installed on the infected machine and terminate if it is found," "CaddyWiper can also halt execution if the compromised host is identified as a domain controller," and "OopsIE checks for information on the CPU fan, temperature, mouse, hard disk, and motherboard as part of its anti-VM checks."
The content repeatedly describes malware and threat actors collecting the username, identifying the current user, enumerating logged-on users, or running commands such as whoami, query user, and quser to determine user context on compromised systems.
The content repeatedly describes malware and threat actors collecting host details such as hostname, OS version, architecture, CPU, memory, BIOS, language, and other machine characteristics; e.g., "Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host."
The below courses of action mitigate the following techniques: Account Discovery [T1087], Domain Trust Discovery [T1482], File and Directory Discovery [T1083]
Les attaquants utilisent notamment les outils Adfind et Sharphound afin de cartographier le réseau. – T1087 : Account Discovery - Reconnaissance de comptes admin [16], [11].
The content repeatedly describes malware and threat actors collecting the current date, time, or time zone from victim systems, including examples such as "The net time command can be used... to determine the local or remote system time" and commands like "net time \\hostname" and "w32tm /tz".
– T1482 : Domain Trust Discovery - Reconnaissance des permissions de domaine [16].
The content includes environment-aware checks such as "Bazar can also check if the Russian language is installed on the infected machine and terminate if it is found," "CaddyWiper can also halt execution if the compromised host is identified as a domain controller," and "OopsIE checks for information on the CPU fan, temperature, mouse, hard disk, and motherboard as part of its anti-VM checks."
Examples include 'Bazar can also check if the Russian language is installed,' 'DropBook has checked for the presence of Arabic language,' 'Maze has checked the language of the infected system,' and 'SynAck ... checks installed keyboard layouts to estimate if it has been launched from a certain list of countries.'
There have also been instances of operators using Cobalt Strike to create an RDP connection with other endpoints on the network and copying Egregor to them.
Pour se déplacer au sein du réseau, les opérateurs d’Egregor utiliseraient des balises SMB via l’outil Cobalt Strike ou des accès administrateurs. ... – T1021.002 : SMB/Windows Admin Shares - Utilisation des Remote Services, notamment SMB/Windows Admin Shares [16].
A ce jour, l’utilisation de techniques d’assombrissement du code (obfuscation), de techniques anti-débogage et l’utilisation des API natives de Windows sont avérées.
The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications.
All four also use the “double extortion” strategy of not just withholding victims’ data, but also publishing pieces of it online as an extra incentive for victims to pay the ransom. | All four use the RaaS model, meaning that affiliates carry out the ransomware attacks themselves and pay a percentage of each victim payment back to the strain’s creators and administrators.
54 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
138 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware observed as a follow-on payload delivered by Quakbot in some infections.
Ransomware payload dropped by Lockean affiliates on systems infected via Qbot/QakBot with TA551 collaboration.
Ransomware family referenced as a group FIN7 previously collaborated with (contextual association, not necessarily tied to the specific Veeam CVEs in this article).
Ransomware referenced as using intimidation and internal defacement techniques such as ransom notes and print bombing during encryption operations.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.