ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Malware

Egregor

0 mentions in 7 days · 1 in 30 days · 1 total · first seen · last

Search everything

Timeline

Threat Assessment: Egregor Ransomware

Unit 42 assesses Egregor ransomware, a Sekhmet variant likely run by former Maze affiliates using Qakbot, IcedID, and Ursnif for initial access.

Since September 2020, Unit 42 observed Egregor ransomware attacks across the U.S., Europe, Asia-Pacific, and Latin America, coinciding with the Maze team's shutdown announcement. Egregor, a variant of the Sekhmet family, uses commodity malware such as Qakbot, IcedID, and Ursnif for initial access, followed by scripts that modify firewalls, enable RDP, and deploy Cobalt Strike for reconnaissance and exfiltration. A PowerShell script uninstalls the McAfee agent and downloads the Egregor DLL via BITS, executed with the -passegregor10 key. Victims face a three-day ransom deadline before exfiltrated data is published on the Egregor Hall of Shame leak site.

Palo Alto Unit 42 · 29d agoRansomware in the wild

Appears with

malware Cobalt Strike 1malware IcedID 1malware Qakbot 1malware Sekhmet 1malware Trickbot 1malware Ursnif 1organization Palo Alto Networks 1organization Unit 42 1product Cortex XDR 1vendor McAfee 1vendor Palo Alto Networks 1
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.