Egregor: The New Ransomware Variant To Watch; it could take up where Maze left off

guest · Nov 26, 2020

Egregor ransomware could take up where Maze left off
November 26, 2020
https://www.itpro.co.uk/security/357901/egregor-ransomware-could-take-up-where-maze-left-off

The hackers behind a new variant of ransomware may have only just started to gain traction, security researchers have warned.

First observed on 25 September, the Egregor ransomware is said to be filling the gap left by the Maze ransomware, which ceased operations last month, according to a blog by researchers at IT security firm Digital Shadows.
The researchers have said the new Egregor strain shares similarities with Maze, including malware signatures, their target victims being within the industrial goods & services sector, and the practice of leaking company’s sensitive data on a dark web-based “News” website.
Click to expand...

Researchers have found that the criminals behind Egregor tend to release packets of data that are easily traceable to the victim while demanding a hefty ransom to prevent further leaks. Most of the victims, according to Digital Shadows, are clustered in the industrial goods & services sector (38%), with a vast majority of victims being US-based companies (83%).
Click to expand...

Digital Shadows: Egregor: The New Ransomware Variant To Watch

First observed on September 25th, 2020, the Egregor ransomware variant has been making considerable strides in Maze’s wake, another ransomware threat actor that ceased operations in October of 2020.
Some security researchers have drawn many parallels between the two groups— including overlap in malware signatures, the victimology (with the majority of victims belonging to the Industrial Goods & Services Sector), and the practice of leaking company’s sensitive data on a dark web based “News” website.

While there is no way of verifying these claims, we can determine from an analysis of their activity and ransomware that Egregor has become the leading variant, with much potential to become a more significant threat to your organization in the coming months.
Click to expand...

guest · Dec 4, 2020

Opportunistic Egregor ransomware is an emerging and active threat
December 4, 2020
https://www.computerweekly.com/news...r-ransomware-is-an-emerging-and-active-threat

Since it was first observed in September 2020, the newly emergent Egregor ransomware has indiscriminately targeted organisations on a global scale and defenders should be alert to this particularly dangerous new strain, according to Recorded Future’s Insikt Group, which has just released detailed research into Egregor.

Part of the Sekhmet ransomware family, Egregor is connected to, and likely used by, the operators of the QakBot or Qbot banking trojan, and is notable for its complexity, employing advanced obfuscation and anti-analysis techniques.

“According to the information available on Egregor News, they claimed 133 victims and are responsible for 13% of all currently known ransomware extortion cases, which is a large number for just two months of operations,” said the researchers.
Click to expand...

Data compiled by Recorded Future suggests that Egregor is now the second most widespread ransomware strain circulating, well behind Maze, which accounts for about 26% of victims this year, but ahead of other high-profile ransomwares such as REvil/Sodinokibi, DoppelPaymer, Clop and Ragnar Locker.

“We believe that ransomware operators and their affiliates are opportunistic by nature and do not focus on specific industries or geographic regions, but rather select and pursue corporations based on accessibility, opportunity and company revenue,” said the researchers.
Click to expand...

The ransomware itself comes in three main stages – a top-level packer that decrypts the next stage, a subsequent stage that uses a cryptographic key passed in at runtime to decrypt the final payload, and finally, Egregor itself. Recorded Future noted that without the correct key passed to the ransomware when it is run, the payload cannot be decrypted or analysed.
Recorded Future said that although there was still much to learn about Egregor, there are a number of steps security defenders can take now.
Click to expand...

Recorded Future: Egregor Ransomware, Used in a String of High-Profile Attacks, Shows Connections to QakBot

Key Judgments

The Egregor ransomware is a complex piece of malware, employing obfuscation and anti-analysis techniques. In order to fully decrypt and deploy the payload, the password associated with the sample must be provided at runtime.

Egregor ransomware is connected to the QakBot operators.

The targets of the Egregor ransomware are organizations, which Egregor both ransoms and uses the “name and shame” double extortion technique to further victimize the companies.

Click to expand...

guest · Dec 9, 2020

Threat Assessment: Egregor Ransomware
December 8, 2020
https://unit42.paloaltonetworks.com/egregor-ransomware-courses-of-action/

Executive Summary
Since September 2020, Unit 42 researchers have observed Egregor ransomware affecting multiple industries globally, including those within the U.S, Europe, Asia Pacific and Latin America, following the decline in operations utilizing the Maze ransomware. Egregor operations mimic that of Maze operations, leading us to believe that although Maze operators announced a shutdown of the “Maze Team Project,” the operators behind those activities have simply developed a new ransomware to move their objectives forward.

Due to the surge in Egregor ransomware activity, we’ve created this general threat assessment for overall threat awareness. Full visualization of the techniques observed and their relevant courses of action can be viewed in the Unit 42 ATOM Viewer.
Click to expand...

Conclusion
In the short period of its observed activities, Egregor ransomware has compromised industries globally, including those within the U.S, Europe, Asia Pacific and Latin America. Organizations should be aware of and monitor the use of commodity malware, such as Qakbot, IcedID and Ursnif, that could end up delivering Egregor ransomware as a second-stage payload. Like Maze and other current variants, Egregor ransomware affiliates use double extortion. They host an extortion website called the “Hall of Shame” site to create additional pressure and shame their victims into paying the ransom.

With the fall of Maze ransomware and the rise of Egregor, we suspect the group behind this ransomware will remain active in the following months and will continue their efforts to target high-profile organizations.
Click to expand...

guest · Dec 15, 2020

Threat profile: Egregor ransomware is making a name for itself
December 15, 2020
https://blog.malwarebytes.com/ranso...regor-ransomware-is-making-a-name-for-itself/

What is Egregor?
Egregor ransomware is a relatively new ransomware (first spotted in September 2020) that seems intent on making its way to the top right now. Egregor is considered a variant of Ransom.Sekhmet based on similarities in obfuscation, API-calls, and the ransom note.

As we’ve reported in the past, affiliates that were using Maze ransomware started moving over to Egregor even before the Maze gang officially announced they were calling it quits. Egregor has already targeted some well-known victims like Barnes & Noble, Kmart and Ubisoft.
Click to expand...

The most common attack method seems to entail an initial spray-and-pray tactic, after which the threat actors make a selection of the available openings. They will obviously go for the easiest and most profitable ones based on primary reconnaissance data from the first stage of the attack.
Egregor does not seem to have a geographical preference, even though Sekhmet has seemed to focus on the US in the past 7 weeks. [...]
Click to expand...

guest · Jan 7, 2021

FBI warns of Egregor ransomware extorting businesses worldwide
January 7, 2021
https://www.bleepingcomputer.com/ne...or-ransomware-extorting-businesses-worldwide/

The US Federal Bureau of Investigation (FBI) has sent a security alert warning private sector companies that the Egregor ransomware operation is actively targeting and extorting businesses worldwide.

The FBI says in a TLP:WHITE Private Industry Notification (PIN) shared on Wednesday that Egregor claims to have already hit and compromised more than over 150 victims since the agency first observed this malicious activity in September 2020.

"Because of the large number of actors involved in deploying Egregor, the tactics, techniques, and procedures (TTPs) used in its deployment can vary widely, creating significant challenges for defense and mitigation," the US intelligence and security service says.
Click to expand...

Egregor started operating after Maze shut down their operation, with many of the Maze affiliates immediately switching to Egregor's RaaS as BleepingComputer was told by threat actors.
Click to expand...

Log in or Sign up

Egregor: The New Ransomware Variant To Watch; it could take up where Maze left off

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Egregor: The New Ransomware Variant To Watch; it could take up where Maze left off

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches