FBI alert on Egregor ransomware highlighted affiliate cybercrime model

Egregor is one of a number of strains classified as ransomware-as-a-service, meaning users can pay a fee to enlist the malicious code for their crime sprees.

An emerging strain of ransomware that was the subject of a recent FBI report is relying on an extortion technique in which attackers publish stolen data to a public website in the event that a victim organization refuses to meet hackers’ demands. 

The Federal Bureau of Investigation in January warned that the gang behind the Egregor ransomware, first detected in September 2020, would compromise a victim’s network, then order a victim to print a physical copy of a ransom note spelling out a demand to pay a specific fee, otherwise risk their stolen data being made public. French and Ukrainian police took action against hackers who used the Egregor malware in February, reportedly arresting “several” suspects. 

In its advisory, the bureau said that attackers can rent Egregor as a ransomware-as-a-service malware, and that it relies on other hacking tools as part of an affiliate model. Egregor frequently comes packaged with penetration testing and exploit tools including Cobalt Strike, Qakbot and software known as Advanced IP Scanner and AdFind, the FBI said. 

The federal government’s warning roughly coincided with a consensus from cybersecurity researchers and private sector firms that the specialists who launch ransomware attacks are a much more concentrated lot than widely understood. 

Egregor is one of a number of strains classified as ransomware-as-a-service, meaning users can pay a fee to enlist the malicious code for their crime sprees.

“In this model, multiple different individuals play a part in conducting a single intrusion and ransomware event,” the FBI alert says. 

“Egregor ransomware utilizes multiple mechanisms to compromise business networks, including targeting business networks and employee personal accounts that share access with business networks or devices,” the notice continues. 

Further investment in the affiliate model also unlocks the services of other professionals who offer access to breached networks, extortion negotiations and customized criminal services. The most prolific crews — Maze, Egregor, SunCrypt and Doppelpaymer — rely on many of the same services to complete their scams, according to recent findings from Chainalysis, which provides intelligence to U.S. law enforcement.

A growing body of research suggests these affiliates launder their stolen money through a relative handful of locations. When a ransomware victim elects to pay an extortion fee in bitcoin, for instance, the thieves need to cover their tracks. Money launderers connected to ransomware groups deposited some 80% of the millions of dollars they received in 2020 into 199 bitcoin wallets, Chainalysis research provided exclusively to CyberScoop showed. Of the total 199, 25 accounts collected 46% of the funds.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

Technology

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

• Election official says Tina Peters would be consultant, won’t have access to election systems