Threat Assessment: Egregor Ransomware
Unit 42 assesses Egregor ransomware, a Sekhmet variant likely run by former Maze affiliates using Qakbot, IcedID, and Ursnif for initial access.
55
Malware
Ursnif
- Mentions · 7d0
- Mentions · 30d0
- All mentions5
- First seenAug 17, 2026
- Last mentionedAug 17, 2026
Timeline
5 articles · newest firstBanking Trojans: Ursnif Global Distribution Networks Identified
Unit 42 maps banking-trojan distribution networks: spam botnets push Shiotob downloaders and Ursnif, KINS, Tinba at Japan and European targets via compromised web servers.
46
Campaign Evolution: EITest from October through December 2016
Unit 42 details the EITest campaign's late-2016 changes: gates and obfuscation dropped, with Rig EK variants delivering ransomware and infostealers.
24
EITest Campaign Evolution: From Angler EK to Neutrino and Rig
Unit 42 details the EITest campaign's shift from Angler to Neutrino and Rig exploit kits while distributing ransomware, downloaders, and banking trojans.
36
How the EITest Campaign's Path to Angler EK Evolved Over Time
Unit 42 documents how the EITest campaign's gate URLs and infrastructure evolved since 2014 while still routing victims to Angler EK and diverse malware.
32
Appears with
- Palo Alto Networksvendor · 5
- Palo Alto Networksorganization · 3
- EITestthreat actor · 3
- Tinbamalware · 3
- Unit 42organization · 3
- Vawtrakmalware · 2
- Gootkitmalware · 2
- Cerbermalware · 2
- Angler EKmalware · 2
- Rig EKmalware · 2
- McAfeevendor · 1
- CryptFile2malware · 1
- KINSmalware · 1
- Bedepmalware · 1
- Beblohmalware · 1
- Sekhmetmalware · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.