Loading story…
The Egregor ransomware operation carried out double-extortion attacks by stealing sensitive data, encrypting victim systems, and threatening to publish stolen information on a leak site if victims refused to pay. Researchers linked Egregor to an ecosystem associated with Sekhmet and possible former Maze affiliates, with additional reported ties to ProLock and LockBit. Victims cited in reporting included GEFCO, Barnes & Noble, and Ubisoft, while the group’s leak site reportedly listed 152 victim companies across industries including information technology, construction, retail, consumer goods, and automotive.
Intrusions commonly began with phishing or RDP exploitation, after which attackers used Cobalt Strike for payload delivery and in some cases leveraged QBot and living-off-the-land tools such as bitsadmin. The malware used heavily obfuscated DLL payloads with Salsa20-encrypted configuration data, required a sample-specific launch key passed with the -p parameter, and encrypted files with ChaCha and RSA-2048. Researchers also observed the group using Rclone with attacker-supplied configuration data to exfiltrate stolen files, while the ransomware appeared to avoid encrypting systems configured with several CIS-region languages.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
The Egregor ransomware family was active starting in mid-September 2020. The group was described as an offshoot of Sekhmet and linked by multiple security firms to former Maze affiliates, with possible ties to ProLock and LockBit.
As of 2020-11-24, Egregor's leak site reportedly listed 152 victim companies across multiple industries worldwide. Information technology, construction, retail, consumer goods, and automotive were the most frequently represented sectors.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
sentinelone.com
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourcecve.mitre.org
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Maze** ransomware operation evolved from earlier exploit-kit activity associated with “ChaCha ransomware” into a prominent double-extortion threat that stole data before encrypting systems and then pressured victims by publishing stolen files on dedicated leak sites. Operators built a public reputation around naming victims, courting media attention, and using data exposure as leverage to increase the likelihood of ransom payments. Maze infections were delivered through multiple channels, including spam campaigns impersonating government tax agencies and later more targeted compromises through **Remote Desktop Protocol (RDP)** access and network exploitation. Sophos reported that the malware used heavy obfuscation, anti-analysis checks, persistence mechanisms, system and network reconnaissance, **HTTP POST** data exfiltration, and file encryption based on **RSA** and **ChaCha20**, while also showing selective behavior such as adjusting demands for home versus corporate systems and easing pressure in some medical-sector cases during COVID-19.
Jun 29, 2026
Researchers reported that a ransomware group tracked as **Crypt Ghouls** targeted Russian businesses and government agencies across mining, energy, finance, retail, and public-sector organizations. The group reportedly gained initial access through compromised contractor VPN credentials, then established persistence with **NSSM** and **Localtonet**, harvested credentials using **XenAllPasswordPro** and **Mimikatz**, and expanded access with reconnaissance and lateral-movement tools including **PingCastle**, **SoftPerfect Network Scanner**, **WMI**, **Impacket** `WmiExec.py`, and **PAExec`. The attackers deployed **LockBit 3.0** on Windows systems and **Babuk** on Linux and **ESXi** environments, indicating a multi-platform ransomware capability. Researchers also found overlaps in tooling, infrastructure, and tactics with activity linked to **MorLock**, **BlackJack**, **Twelve**, and **Shedding Zmiy/(Ex)Cobalt**, suggesting collaboration, shared tooling, or intelligence exchange among multiple groups focused on Russian targets.
Jun 29, 2026
The **Anubis** ransomware operation has grown into a structured cybercriminal ecosystem that combines public branding, affiliate recruitment, and multi-platform extortion services. Researchers linked the group’s leak sites, onion infrastructure, forum accounts, and the recurring **"Anubis Media"** persona into a unified operation that promoted ransomware and data-extortion offerings across underground communities including **XSS**, **BreachForums**, **ReHub**, and **RAMP**, as well as **X**. The group reportedly listed **83 victims** between February 2025 and June 2026, sought corporate access in the United States, Canada, Europe, and Australia, and advertised support for **Windows, Linux, NAS, and ESXi** environments with capabilities such as privilege escalation, shadow copy removal, network-wide deployment, and multiple encryption modes. Separate incident reporting tied Anubis-linked intrusions to practical affiliate tradecraft centered on stolen **VPN credentials** and exploitation of **CitrixBleed 2** (`CVE-2025-5777`) on Citrix NetScaler appliances. In observed attacks, operators blended into normal administration by deploying legitimate remote-management tools including **ScreenConnect, Zoho Assist, MeshAgent, Remotely, UltraVNC, Total Software Deployment,** and **mRemoteNG**, then moved laterally with **RDP, SMB,** and **PsExec**. They also harvested credentials with **Mimikatz**, browser password exports, and `ntds.dit` theft, used tools such as **S3 Browser, rclone, s5cmd, WinSCP,** and **PuTTY** for exfiltration staging, and in some cases established fallback access through **cloudflared**, authenticated proxies, and **SSH SOCKS** tunnels, including activity involving Synology NAS devices.
Jul 4, 2026