Egregor

Malware updated 3 days ago (2024-10-15T10:02:33.349Z)

Download STIX

Preview STIX

Egregor is a malicious software variant of the Sekhmet ransomware that operates on a Ransomware-as-a-Service (RaaS) model. It is speculated to be associated with former Maze affiliates, and is notorious for its double extortion tactics, which involve not only encrypting the victim's data but also publicly shaming them by leaking sensitive information. Egregor has been implicated in numerous high-profile attacks, including breaches at Ubisoft and Crytek in 2020, where it was deployed to steal and leak game source code. The Egregor ransomware gained access to systems through various methods, often leveraging other malware like Qakbot as an initial infection vector. This Trojan has been used by multiple ransomware groups, including Conti, ProLock, REvil, RansomExx, MegaCortex, and most recently, Black Basta. In a 2020 intrusion, threat actors deployed Egregor several months after GOLD MELODY obtained access to the environment. Tools like MegaSync and Rclone have also been observed in use in Egregor incidents, aiding in the ransomware's operations. Despite its widespread activity, efforts to combat Egregor have seen some success. A number of Egregor affiliates were arrested in February 2021, causing disruption to the group's operations. Furthermore, decryption tools for Egregor, along with other ransomwares like Maze and Sekhmet, have been developed and are available online, offering victims a potential means of recovering their encrypted data without paying the ransom. However, the ongoing prevalence of Egregor underscores the importance of robust cybersecurity measures to prevent initial access and infection.

Description last updated: 2024-10-15T09:25:55.952Z

What's your take? (Question 1 of 5)

Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.

Aliases We are not currently tracking any aliases

Miscellaneous Associations

Other elements of context that could aid in the identification of relevance

Ransomware

Malware

Ransom

Analyst Notes & Discussion

Be the first to leave your mark here! Log in to share your views and vote.

Associated Malware

To see the evidence that has resulted in these malware associations, create a free account

Alias Description	Association Type	Votes
The Qbot Malware is associated with Egregor. Qbot, also known as Qakbot or Pinkslipbot, is a modular information stealer malware that first emerged in 2007 as a banking trojan. Its evolution has seen it become an advanced strain of malware used by multiple cybercriminal groups to prepare compromised networks for ransomware infestations. The fi	Unspecified	3
The Conti Malware is associated with Egregor. Conti is a notorious type of malware, specifically ransomware, that infiltrates computer systems to steal data and disrupt operations. The malicious software often spreads through suspicious downloads, emails, or websites, and once inside, it can hold data hostage for ransom. The Conti ransomware op	Unspecified	3
The MegaCortex Malware is associated with Egregor. MegaCortex is a type of malware known for its harmful effects on computer systems and devices. It was identified by Dragos, a cybersecurity firm, as having a relationship with another ransomware called EKANS. Both MegaCortex and EKANS have specific characteristics that pose unique risks to industria	Unspecified	2
The Black Basta Malware is associated with Egregor. Black Basta is a notorious malware and ransomware group known for its high-profile attacks on various sectors. The group, also known as Storm-0506, has been active since at least early 2022 and has accumulated over $107 million in Bitcoin ransom payments. It deploys malicious software to exploit vul	Unspecified	2
The REvil Malware is associated with Egregor. REvil is a notorious malware, specifically a type of ransomware, that gained prominence in the cybercrime world as part of the Ransomware as a Service (RaaS) model. This model became increasingly popular in 2020, establishing relationships between first-stage malwares and subsequent ransomware attac	Unspecified	2
The QakBot Malware is associated with Egregor. Qakbot is a potent piece of malware, or malicious software, that infiltrates computer systems through suspicious downloads, emails, or websites. Once installed, it can steal personal information, disrupt operations, or even hold data hostage for ransom. This malware, built by various groups includin	Unspecified	2
The ProLock Malware is associated with Egregor. ProLock is a type of malware, specifically ransomware, that is designed to infiltrate computer systems, often unbeknownst to the user. It typically enters systems through suspicious downloads, emails, or websites. Once inside, ProLock can steal personal information, disrupt operations, and hold data	Unspecified	2

Associated Threat Actors

To see the evidence that has resulted in these threatActor associations, create a free account

Alias Description	Association Type	Votes
The Alphv Threat Actor is associated with Egregor. AlphV, also known as BlackCat, is a notorious threat actor that has been active since November 2021. This group pioneered the public leaks business model and has been associated with various ransomware families, including Akira, LockBit, Play, and Basta. AlphV gained significant attention for its la	Unspecified	2

Source Document References

Information about the Egregor Malware was read from the documents corpus below. This display is limited to 20 results, create a free account to see more

Source Link	CreatedAt	Title
CERT-EU	10 months ago	Ubisoft says it's investigating reports of a new security breach
CERT-EU	9 months ago	Examples of Past and Current Attacks \| #ransomware \| #cybercrime \| National Cyber Security Consulting
CERT-EU	10 months ago	The law enforcement operations targeting cybercrime in 2023
Securityaffairs	10 months ago	Video game giant Ubisoft investigates reports of a data breach
MITRE	10 months ago	Threat Assessment: Black Basta Ransomware
CERT-EU	a year ago	Defend Against Cyber Threats: Understanding Each Ransomware Type
DARKReading	a year ago	'Gold Melody' Access Broker Plays on Unpatched Servers' Strings
CERT-EU	a year ago	GOLD MELODY: Profile of an Initial Access Broker
CERT-EU	a year ago	Cyber Group 'Gold Melody' Selling Compromised Access to Ransomware Attackers
CERT-EU	a year ago	How the FBI nuked Qakbot malware from infected Windows PCs
CERT-EU	a year ago	Qakbot botnet dismantled after infecting over 700,000 computers
CERT-EU	a year ago	What Is Double Extortion Ransomware?
CERT-EU	a year ago	Focus on DroxiDat/SystemBC – GIXtools
CERT-EU	a year ago	Focus on DroxiDat/SystemBC
CERT-EU	a year ago	200+ Free Ransomware Decryption Tools You Need [2022 List]
InfoSecurity-magazine	a year ago	Manufacturing Sector Reeling From Financial Costs of Ransomware
CERT-EU	a year ago	News Alert: Lumu announces launch of new threat hunting service to come at Black Hat USA 2023 \| The Last Watchdog
CERT-EU	a year ago	8Base Ransomware Group Emerges as Major Threat
CERT-EU	a year ago	Regis Aged Care upgrades endpoint security
MITRE	2 years ago	Cybereason vs. Conti Ransomware