Threat Assessment: Egregor Ransomware
Unit 42 assesses Egregor ransomware, a Sekhmet variant likely run by former Maze affiliates using Qakbot, IcedID, and Ursnif for initial access.
Since September 2020, Unit 42 observed Egregor ransomware attacks across the U.S., Europe, Asia-Pacific, and Latin America, coinciding with the Maze team's shutdown announcement. Egregor, a variant of the Sekhmet family, uses commodity malware such as Qakbot, IcedID, and Ursnif for initial access, followed by scripts that modify firewalls, enable RDP, and deploy Cobalt Strike for reconnaissance and exfiltration. A PowerShell script uninstalls the McAfee agent and downloads the Egregor DLL via BITS, executed with the -passegregor10 key. Victims face a three-day ransom deadline before exfiltrated data is published on the Egregor Hall of Shame leak site.
- Egregor is a Sekhmet variant likely run by former Maze operators
- Initial access via Qakbot, IcedID, and Ursnif commodity malware
- BITS-based download executed with -passegregor10 command-line key
- Three-day ransom deadline before leak site exposure
- ATT&CK
- T1566.001 Spearphishing AttachmentT1190 Exploit Public-Facing ApplicationT1059.001 PowerShellT1486 Data Encrypted for Impact
- Vendors
- Palo Alto NetworksMcAfee
- Products
- Cortex XDR
- Organizations
- Palo Alto NetworksUnit 42
- Countries
- United States
From the original article
5 min read at unit42.paloaltonetworks.com
Since September 2020, Unit 42 researchers have observed Egregor ransomware affecting multiple industries globally, including those within the U. S, Europe, Asia Pacific and Latin America, following the decline in operations utilizing the Maze ransomware.
By Doel Santos, Brittany Barbehenn · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.