Skip to main content
Egregor Ransomware

Egregor is a new RaaS tool targeting high-value organisations across a variety of industries and countries. The Maze group appears to have adopted it as their primary ransom tool in light of the shut down of their own ransomware and associated leak site.

Report a cyber attack: call 0300 303 5222 or email carecert@nhsdigital.nhs.uk

Summary

Egregor is a new RaaS tool targeting high-value organisations across a variety of industries and countries. The Maze group appears to have adopted it as their primary ransom tool in light of the shut down of their own ransomware and associated leak site.


Affected platforms

The following platforms are known to be affected:

Threat details

Introduction

First observed in September 2020, Egregor is a sophisticated ransomware-as-a-service (RaaS) tool that appears to have been adopted by the Maze ransomware operators and their affiliates following the takedown of their own tool. It is used in high-profile attacks against large organisations globally.

Despite bearing many similarities to Maze, it is unclear if Egregor was created by Maze's operators.


Delivery

Like most RaaS tools, Egregor can be delivered in any manner affiliate users choose, although the majority of observed infections have distributed it as secondary payload in remote access trojan attacks, notably Qbot.

Interestingly, all Egregor payloads provided to affiliates are custom-packed and encrypted to prevent analysis. When delivered, an affiliate-defined parameter must be passed to the payload in order to decrypt and execute it.

 


Activities

Once delivered, Egregor will perform a sequence of language checks in a similar manner to both Maze and Sekhmet, before attempting to enumerate all connected drives. If successful, it connects to a command and control (C2) server to grab a list of directories present on the enumerated drives to search. Any files in these directories are then extracted and sent back to the C2 server

Egregor will only begin encrypting files once a command is sent by it's operators, presumably when they are satisfied with the information it has extracted. All non-system files are then encrypted using a hybrid AES-RSA implementation, before a ransom note is dropped on the desktop. Some Egregor variants will also attempt to display the ransom note on connected peripherals such as screens or printers


Threat updates

Date Update
19 Feb 2021 Egregor suspects arrested

A number of suspected actors behind Egregor attacks have reportedly been arrested in Ukraine. The action appears to have caused much of Egregor's infrastructure to go offline.


Remediation advice

If a device on your network becomes infected with ransomware it will begin encrypting files, which may also include remote files on network locations. The only guaranteed way to recover from a ransomware infection is to restore all affected files from their most recent backup. To limit the impact of a ransomware infection, NHS Digital advises that:

  • Critical data is frequently saved in multiple backup locations.
  • At least one backup is kept offline at any time (separated from live systems).
  • Backups and incident recovery plans are tested to ensure that data can be restored when needed.
  • User account permissions for modifying data are regularly reviewed and restricted to the minimum necessary.
  • Infected systems are disconnected from the network and powered down as soon as practicable.
  • Any user account credentials that may have been compromised should be reset on a clean device
  • Where infected systems cannot be quarantined with confidence, then an affected organisation should disconnect from national networks to limit propagation.

Additionally, to prevent and detect an infection, NHS Digital advises that:

  • Secure configurations are applied to all devices.
  • Security updates are applied at the earliest opportunity.
  • Tamper protection settings in security products are enabled where available.
  • Obsolete platforms are segregated from the rest of the network.
  • IT usage policies are reinforced by regular training to ensure all users know not to open unsolicited links or attachments.
  • Multi-factor authentication (MFA) and lockout policies are used where practicable, especially for administrative accounts.
  • Administrative accounts are only used for necessary purposes.
  • Remote administration services use strongly encrypted protocols and only accept connections from authorised users or locations.
  • Systems are continuously monitored, and unusual activity is investigated, so that a compromise of the network can be detected as early as possible.

Please note that NCSC maintains guidance for securely configuring a wide range of end user device (EUD) platforms. For further details refer to their end user device security guidance pages.


Indicators of compromise

Network indicators

IP addresses

  • 185[.]238[.]0[.]233
  • 217[.]8[.]117[.]148
  • 45[.]11[.]19[.]70
  • 45[.]153[.]242[.]129
  • 45[.]153[.]242[.]129
  • 49[.]12[.]104[.]241:81

Domains

  • egregor4u5ipdzhv[.]onion
  • egregoranrmzapcv[.]onion
  • egregornews[.]co

Host indicators

SHA256 hashes

  • 004a2dc3ec7b98fa7fe6ae9c23a8b051ec30bcfcd2bc387c440c07ff5180fe9a
  • 14e547bebaa738b8605ba4182c4379317d121e268f846c0ed3da171375e65fe4
  • 2b3518937fd231560c7dc4f5af672a033b1c810d7f2f82c8151c025ce75775bf
  • 3aad14d200887119f316be71d71aec11735dd3698a4fcaa50902fce71bdccb07
  • 3e5a6834cf6192a987ca9b0b4c8cb9202660e399ebe387af8c7407b12ae2da63
  • 3fc382ae51ceca3ad6ef5880cdd2d89ef508f368911d3cd41c71a54453004c55
  • 3fd510a3b2e0b0802d57cd5b1cac1e61797d50a08b87d9b5243becd9e2f7073f
  • 444a6897058fd4965770167b15a2ab13e6fd559a3e6f6cf5565d4d3282587459
  • 4ea8b8c37cfb02ccdba95fe91c12fb68a2b7174fdcbee7ddaadded8ceb0fdf97
  • 608b5bf065f25cd1c6ac145e3bcdf0b1b6dc742a08e59ec0ce136fe5142774e9
  • 6ad7b3e0873c9ff122c32006fdc3675706a03c4778287085a020d839b74cd780
  • 765327e1dc0888c69c92203d90037c5154db9787f54d3fc8f1097830be8c76ab
  • 8483aaf9e1fa5b46486c9f2a14c688c30d2006e88de65d0295a57892de0bf4c9
  • 9017c070ad6ac9ac52e361286b3ff24a315f721f488b53b7aaf6ac35de477f44
  • 932778732711cd18d5c4aabc507a65180bf1d4bd2b7d2d4e5506be4b8193596e
  • a9d483c0f021b72a94324562068d8164f8cce0aa8f779faea304669390775436
  • c3c50adcc0a5cd2b39677f17fb5f2efca52cc4e47ccd2cdbbf38815d426be9e1
  • ee06c557f1acd5c4948b1df0413e49f3885f8ac96185a9d986b91a1231444541
  • f0adfd3f89c9268953f93bfdfefb84432532a1e30542fee7bddda14dcb69a76c

Last edited: 19 February 2021 12:53 pm