Loading story…
The Egregor ransomware operation carried out double-extortion attacks by stealing sensitive data, encrypting victim systems, and threatening to publish stolen information on a leak site if victims refused to pay. Researchers linked Egregor to an ecosystem associated with Sekhmet and possible former Maze affiliates, with additional reported ties to ProLock and LockBit. Victims cited in reporting included GEFCO, Barnes & Noble, and Ubisoft, while the group’s leak site reportedly listed 152 victim companies across industries including information technology, construction, retail, consumer goods, and automotive.
Intrusions commonly began with phishing or RDP exploitation, after which attackers used Cobalt Strike for payload delivery and in some cases leveraged QBot and living-off-the-land tools such as bitsadmin. The malware used heavily obfuscated DLL payloads with Salsa20-encrypted configuration data, required a sample-specific launch key passed with the -p parameter, and encrypted files with ChaCha and RSA-2048. Researchers also observed the group using Rclone with attacker-supplied configuration data to exfiltrate stolen files, while the ransomware appeared to avoid encrypting systems configured with several CIS-region languages.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
The Egregor ransomware family was active starting in mid-September 2020. The group was described as an offshoot of Sekhmet and linked by multiple security firms to former Maze affiliates, with possible ties to ProLock and LockBit.
As of 2020-11-24, Egregor's leak site reportedly listed 152 victim companies across multiple industries worldwide. Information technology, construction, retail, consumer goods, and automotive were the most frequently represented sectors.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 45 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
6 references tracked. Mallory keeps watching after this page renders.
sentinelone.com
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourcecve.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Egregor emerged as a ransomware-as-a-service operation tied to the **Sekhmet/Maze** lineage and rapidly targeted organizations worldwide, including at least **69 victims** observed by France’s ANSSI, with some ransom demands exceeding **$4 million**. The group encrypted files with randomized extensions, dropped the ransom note `RECOVER-FILES.txt`, and threatened to publish stolen data within three days if victims did not negotiate through Tor-based payment and chat portals. Researchers linked Egregor to former Maze affiliates based on code overlap, shared infrastructure, similar ransom notes, and the migration of operators after Maze’s shutdown. Intrusions commonly began with phishing or illicit **RDP** access and frequently involved **Qakbot**, **IcedID**, **Ursnif**, **Cobalt Strike**, **AdFind**, **SharpHound**, **PsExec**, and **RClone** for reconnaissance, lateral movement, and exfiltration before encryption. Technical analyses described obfuscated DLL payloads, process injection, defense evasion, shadow-copy deletion, and file encryption using **ChaCha** with **RSA-2048**, while the malware avoided systems configured for several CIS-region languages. Egregor was linked to attacks on organizations including **GEFCO, Barnes & Noble, and Ubisoft**, and operated a public leak site—described by some researchers as a **“Hall of Shame”**—to pressure non-paying victims.
Aug 15, 2026
Maze and Ragnar Locker were reported using increasingly sophisticated **double-extortion** tactics that combined data theft, public leak threats, and defense evasion during ransomware intrusions. Maze operators were linked to incidents including the attack on **Cognizant** and the publication of **2GB** of allegedly stolen files from the **City of Pensacola**, underscoring that victims faced both operational disruption and potential data-breach exposure. Reporting also tied Maze to intrusion activity using exposed **RDP**, signed **Cobalt Strike** payloads, **ngrok** tunneling, remote execution with `mshta`, and tailored persistence mechanisms, with one investigated intrusion stopped before encryption was launched. A key technical shift was the adoption of **virtual-machine-based encryption** to bypass endpoint defenses. In a Sophos-investigated case, Maze failed twice after security software blocked ransomware launched through scheduled tasks, then succeeded in deploying an **MSI** package that installed **VirtualBox** and a customized **Windows 7** VM, mounted host drives, and encrypted files from inside the guest system. That approach mirrored **Ragnar Locker**, which had already used a smaller **Windows XP** VirtualBox image to make encryption appear to come from a trusted process while continuing its broader playbook of RDP-driven access, lateral movement, shadow-copy deletion, service termination, and **Salsa20** plus **RSA-2048** encryption backed by leak-site extortion.
Aug 15, 2026
Ransomware operators behind **REvil/Sodinokibi** and **DoppelPaymer** increasingly ran intrusions like targeted espionage campaigns, combining long dwell times, privilege escalation, lateral movement, data theft, and enterprise-wide encryption. Research from Mandiant, Secureworks, JPCERT/JSAC, and CERT-FR describes attackers gaining entry through exposed **RDP** and **VPN** services, phishing-delivered malware such as **QAKBOT**, **Emotet**, and **Dridex**, brute force, and exploitation of internet-facing systems, then expanding control with tools including **Mimikatz**, **BloodHound**, **PsExec**, **WMI**, **Cobalt Strike**, and **Empire**. In many cases, affiliates or partner crews obtained domain administrator access, tampered with backups and security tools, abused Active Directory group policy and scheduled tasks, and used open SMB shares or administrative utilities to push ransomware across networks. REvil also helped normalize **double extortion** by stealing data before encryption, threatening public leaks, and in some cases publishing victim files or warning that stolen information could be sold or used to pressure public companies through market disclosure. Reporting on Sodinokibi showed the gang first releasing allegedly stolen victim data after nonpayment and later promoting leak-site tactics as a standard coercion method, while Sophos observed exfiltration in roughly half of investigated REvil incidents, often staging data in **Mega.nz**. Separate reporting said REvil’s operators secretly retained a master decryption capability and allegedly hijacked affiliate negotiations, underscoring how ransomware-as-a-service groups maintained centralized control even as affiliates conducted the intrusions.
Aug 15, 2026