Egregor

MITRE ATT&CK: S0554 View on attack.mitre.org

Aliases: Egregor

First seen
2020-09-01 00:00:00
Malware type
ransomware
Family
Malware family
Operating systems
windows
Related IoCs
11 (11 malicious)
Last IoC activity
2026-10-10 13:30:20
Profile updated
2026-07-07 12:57:16

Targeted industries: financial-services healthcare-and-pharmaceutical manufacturing technology-and-telecommunications media-and-entertainment

Context

Egregor is a Ransomware-as-a-Service (RaaS) tool that was first observed in September 2020. Researchers have noted code similarities between Egregor and Sekhmet ransomware, as well as Maze ransomware.

Recent IoC activity

11 malicious indicators in Maltiverse are attributed to Egregor (S0554). The 11 most recently updated:

TypeIndicatorUpdatedSources
file sample sub_2d563dd113a0.bin 2026-10-10 2
file sample sub_6a441734b34c.bin 2026-10-07 2
file sample 0fafc1219d1b2ae1485ecc10809c59c655782b48895c7fa72148acf831c20749 2026-09-03 1
file sample 2026-03-05_e74179bf523575403af96ff82ed59ad7_amadey_cobalt-strike_elex_luca-st... 2026-09-03 1
file sample f0a7ea274f0f17cdb4557661eb50d2a572582db9b68b28090440d3f8dcd23f96 2026-08-12 1
file sample d59b69b897485e72f819646efc4e72305d0ef8c9fdc56c72135d430da7f5d9ce 2026-08-12 1
file sample ac78b5caa7b8932cd745b83940437f4caf6de9e88c4e54bd1eedee667a19eba2 2026-08-12 1
file sample 843fabc75ca67f1fc04b2d94cbd0ae00657f10ca440749a8f50735e0245c6d92 2026-08-12 1
file sample 09941830bf4e3b31546f22fd3a9e5b259944adfe106d92c1400d9206e3dc14e2 2026-08-12 1
file sample sub_6675c2048444.bin 2026-08-02 2
file sample 2026-07-14_0a15a276373677f7fd6908ad03bccb1b_amadey_cobalt-strike_coinminer_gl... 2026-07-14 1

Detection coverage

  • 4 YARA rules
  • 761 Sigma rules

Malware & tools used

  • Time Based Checks (attack-pattern)
  • Rundll32 (attack-pattern)
  • BITS Jobs (attack-pattern)
  • System Time Discovery (attack-pattern)
  • Software Packing (attack-pattern)
  • Data from Network Shared Drive (attack-pattern)
  • Native API (attack-pattern)
  • Deobfuscate/Decode Files or Information (attack-pattern)
  • Masquerade Task or Service (attack-pattern)
  • System Network Connections Discovery (attack-pattern)
  • System Owner/User Discovery (attack-pattern)
  • Ingress Tool Transfer (attack-pattern)
  • Disable or Modify Tools (attack-pattern)
  • Virtualization/Sandbox Evasion (attack-pattern)
  • DLL (attack-pattern)
  • Data Encrypted for Impact (attack-pattern)
  • Domain Groups (attack-pattern)
  • Regsvr32 (attack-pattern)
  • Web Protocols (attack-pattern)
  • Remote Access Tools (attack-pattern)
  • Windows Command Shell (attack-pattern)
  • Group Policy Modification (attack-pattern)
  • Process Injection (attack-pattern)
  • PowerShell (attack-pattern)
  • System Information Discovery (attack-pattern)

Used by threat actors

Detection rules

  • TRELLIX_ARC_Ransom_Egregor (yara-rule)
  • ARKBIRD_SOLG_Ran_Egregor_Sept_2020_1 (yara-rule)
  • ARKBIRD_SOLG_Ran_Egregor_Oct_2020_1 (yara-rule)
  • DITEKSHEN_MALWARE_Win_Egregor (yara-rule)

Related threat objects

Reports & references

  • CrowdStrike — Prophet Spider Exploits Oracle Weblogic To Facilitate Ransomware Activity (report)
  • proofpoint.com — First Step Initial Access Leads Ransomware (report)
  • analyst1.com — Ransom Mafia Analysis Of The Worlds First Ransomware Cartel (report)
  • CrowdStrike — Report2021Gtr (report)
  • blog.chainalysis.com — Ransomware Connections Maze Egregor Suncrypt Doppelpaymer (report)
  • zdnet.com — The Malware That Usually Installs Ransomware And You Need To Remove Right Away (report)
  • blog.minerva-labs.com — Egregor Ransomware An In Depth Analysis (report)
  • news.sophos.com — Egregor Ransomware Mazes Heir Apparent (report)
  • Kaspersky — 99255 (report)
  • securityaffairs.co — Egregor Sekhmet Decryption Keys (report)
  • bleepingcomputer.com — Crytek Confirms Egregor Ransomware Attack Customer Data Theft (report)
  • bleepingcomputer.com — Maze Ransomware Is Shutting Down Its Cybercrime Operation (report)
  • bleepingcomputer.com — Ransomware Dev Releases Egregor Maze Master Decryption Keys (report)
  • cert.ssi.gouv.fr — Certfr 2021 Cti 007 (report)
  • Mandiant — Melting Unc2198 Icedid To Ransomware Operations (report)
  • appgate.com — Appgate Labs Analyzes New Family Of Ransomware Egregor (report)
  • bleepingcomputer.com — Crytek Hit By Egregor Ransomware Ubisoft Data Leaked (report)
  • cybersecuritynews.com — Egregor Ransomware (report)
  • securityboulevard.com — Egregor Sekhmets Cousin (report)
  • ransomlook.io — Egregor (report)
  • bleepingcomputer.com — Egregor Ransomware Linked To Maze Arrests Made In Ukraine (report)
  • Trend Micro — Egregor Ransomware Emerges As Maze Shuts Down Operations (report)
  • zdnet.com — Egregor Ransomware Gang Arrested In Ukraine (report)
  • bleepingcomputer.com — Lockbit Ransomware Now Encrypts Windows Domains Using Group Policies (report)
  • blog.bushidotoken.net — Gamer Cheater Hacker Spy (report)

External references