Egregor
Intelligence Profile
According to Heimdal, Egregor ransomware infection happens via a loader, then, in the victim’s firewall, it enables the Remote Desktop Protocol. After this part, the malware is free to move inside the victim’s network, identifying and disabling all the antivirus software it can find. The next step is the encryption of the data and the insertion of a ransom note named “RECOVER-FILES.txt” in all the compromised folders.
Intelligence Assessment
Egregor, also known as win.egregor, is a financially motivated threat group assessed as having high sophistication. It operates as ransomware.
Egregor has targeted 6 victims in total, with no activity in the last 90 days. Top sectors include Commercial Facilities, Financial Services, Healthcare, and Transportation/Logistics, with top countries being US, CA, CL, and FR.
Egregor appears dormant, with no activity since February 8, 2021. Its last reported activity was over a year ago.
Threat Analysis
Egregor is a high-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of financial.
Financially motivated threat actors like Egregor prioritize monetary gain through methods such as ransomware deployment, banking trojans, cryptocurrency theft, BEC scams, or credential harvesting for resale on underground markets.
With high sophistication, Egregor is capable of targeted intrusions using adapted commodity tools alongside custom implants, maintaining operational security and evading standard detection mechanisms.
Ransomware Victims (6)
CTIWATCH tracks 6 organizations claimed as victims by Egregor on its data leak site, with attack dates, sectors and countries.
View full victims list →