Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Threat Assessment: Egregor Ransomware

Summary: Unit 42 researchers have observed Egregor ransomware affecting industries across the U.S., Europe, Asia Pacific and Latin America since September 2020, around the time Maze operators announced a shutdown, and assess that Maze affiliates likely moved to Egregor, a variant of the Sekhmet family. Egregor uses commodity malware such as Qakbot, IcedID and Ursnif for initial access, then modifies firewalls to enable RDP, uses Cobalt Strike for reconnaissance and lateral movement, and runs double extortion through a 'Hall of Shame' site with a three-day payment deadline.

Key Takeaway: The operators behind Maze did not disappear when Maze shut down - they rebuilt and kept their affiliate network, so a three-day deadline now carries the added threat of publishing exfiltrated data on a public Hall of Shame.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related