Loading malware…
Sekhmet is a Windows ransomware family first observed in March 2020 and closely associated with the Maze and Egregor ransomware lineage. Multiple analyses describe Sekhmet as nearly identical to Maze aside from minor implementation differences such as file-marker handling, while Egregor is widely characterized as a direct variant or offshoot of Sekhmet. The family was active during the rise of double-extortion ransomware operations and is linked to leak-site based coercion in which operators not only encrypted victim files but also stole unencrypted data and threatened public disclosure if victims refused to negotiate or pay.
Sekhmet encrypts files and appends a random extension. Reporting and ransom-note analysis tie the family to ChaCha-based file encryption, and operationally it follows the same extortion model seen in Maze and later Egregor. Victims were instructed to contact the operators through dedicated negotiation infrastructure, and the operation maintained a public leak site used to pressure non-paying organizations. Sekhmet has also been identified among ransomware groups that escalated pressure by calling victims directly during negotiations.
The malware targeted enterprise environments rather than commodity consumer infections and fits the broader big-game-hunting trend of 2020. It is associated with theft of sensitive corporate data prior to encryption, public shaming or leak threats, and conventional ransomware impact on business operations. The family is notable historically because it sits between Maze and Egregor in both code lineage and operational evolution, and because later public release of master decryption keys enabled free decryption for some victims when paired with the required ransom-note material.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Этот крипто-вымогатель шифрует данные бизнес-пользователей и компаний с помощью RSA-2048 + ChaCha, а затем требует выкуп... Вымогатели, распространяющие Sekhmet, угрожают опубликовать украденные данные с целью усиления давления на жертву.
Both Egregor and Maze, as well as Sekhmet, were attributed to the same group of organized cybercriminals tracked altogether as the TwistedSpider cryptonym by CrowdStrike.
14 distinct techniques documented for this family, organized by ATT&CK tactic.
some ransomware gangs are now cold-calling victims on their phones if they suspect that a hacked company might try to restore from backups and avoid paying ransom demands.
...обманных загрузок, ботнетов, эксплойтов, вредоносной рекламы, веб-инжектов, фальшивых обновлений...
Может распространяться путём взлома через незащищенную конфигурацию RDP, с помощью email-спама и вредоносных вложений
...с помощью email-спама и вредоносных вложений, обманных загрузок... перепакованных и заражённых инсталляторов.
The two strains share some core features, use similar obfuscation technique.
Для обеспечения запуска используется Regsvr32... Запуск обеспечивается с помощью следующей команды: "C:\Windows\System32\regsvr32.exe" /s sekhmet.dll.exe
Может распространяться путём взлома через незащищенную конфигурацию RDP
We have also downloaded a lot of private data from your network, so in case of not contacting us as soon as possible this data will be released.
To contact us and purchase the key you have to visit our website in a hidden TOR network.
Как известно из других Ransomware, для этого операторы-вымогатели начинают кражу данных ещё перед шифрованием файлов... We downloaded confidential and private data.
After the payment the data will be removed from our disks and decryptor will be given to you
As 14 ransomware gangs are now stealing data and publishing it in their blogs, we can assume that more ransomware operators will adopt the tactic and will require double ransoms.
the tactics used by ransomware gangs to put pressure on victims to pay ransom demands after they've encrypted corporate networks.
Вымогатели, распространяющие Sekhmet, угрожают опубликовать украденные данные с целью усиления давления на жертву... Your company network has been hacked and breached. We downloaded confidential and private data. In case of not contacting us in 3 business days this data will be published on a special website available for public view.
30 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
31 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.