Full Report
Analysis of TTPs employed by Egregor operators
Analysis Summary
# Tool/Technique: Egregor Ransomware
## Overview
Egregor is a sophisticated ransomware-as-a-service (RaaS) variant that emerged in late 2020. It gained notoriety for "Big Game Hunting," targeting large enterprises with high ransom demands. It is widely considered a successor to the Maze ransomware, as many affiliates migrated to Egregor following the former's announced retirement. It utilizes a "double extortion" model, where data is exfiltrated before encryption to pressure victims into paying.
## Technical Details
- **Type:** Malware Family (Ransomware)
- **Platform:** Windows
- **Capabilities:** Data exfiltration, advanced obfuscation, anti-analysis checks, lateral movement, and large-scale file encryption.
- **First Seen:** September 2020
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.001 - Phishing: Spearphishing Attachment] (Often delivered via Qakbot/Qbot)
- **[TA0008 - Lateral Movement]**
- [T1021.001 - Remote Services: Remote Desktop Protocol]
- [T1570 - Lateral Tool Transfer]
- **[TA0005 - Defense Evasion]**
- [T1027 - Obfuscated Files or Information]
- [T1140 - Decompile/Decode Files or Information]
- **[TA0010 - Exfiltration]**
- [T1048 - Exfiltration Over Alternative Protocol]
- **[TA0040 - Impact]**
- [T1486 - Data Encrypted for Impact]
- [T1490 - Inhibit System Recovery]
## Functionality
### Core Capabilities
- **Encryption:** Uses a hybrid encryption scheme. A local private key is generated for each infected machine, which is then encrypted by a public master key and appended to the ransom note's "technical block."
- **Persistence/Testing:** Creates a temporary shortcut named after the victim’s ID (derived from hardware config) in directories to test write permissions using `FILE_FLAG_DELETE_ON_CLOSE`.
- **Ransom Manifest:** Drops a file named `RECOVER-FILES.txt` in every directory containing encrypted files.
### Advanced Features
- **Payload Obfuscation:** The Egregor payload often requires specific command-line arguments to execute, hindering automated sandbox analysis.
- **Payload Delivery:** Frequently utilizes Cobalt Strike for post-exploitation and lateral movement.
- **Anti-Analysis:** Includes checks for debuggers and virtual machine environments to evade detection by security researchers.
## Indicators of Compromise
- **File Names:** `RECOVER-FILES.txt` (Ransom Note), `*.egregor` (Common encrypted extension).
- **Behavioral Indicators:**
- Massive file rename/write operations.
- Execution of Cobalt Strike beacons.
- Abuse of `wmic`, `PowerShell`, and `BITS` for file transfer and execution.
- Unusual RDP traffic across the internal network.
- **Network Indicators:** (Examples of C2 behavior - *Note: Specific IPs/Domains vary by campaign*)
- `[defanged_ip][:]443`
- `[defanged_domain][.]com/admin/login.php`
## Associated Threat Actors
- **Egregor Operators/Affiliates**
- **Maze Affiliates** (Transitioned to Egregor)
- **Qakbot/Qbot operators** (Often facilitate initial access)
## Detection Methods
- **Signature-based detection:** Monitoring for known hashes of the Egregor DLL and Cobalt Strike beacons.
- **Behavioral detection:**
- Identifying the creation of high-volume temporary shortcuts with the `FILE_FLAG_DELETE_ON_CLOSE` flag.
- Monitoring for `vssadmin.exe delete shadows` to prevent system recovery.
- **YARA Rules:** Target the unique technical block structure at the end of the Egregor ransom note and the specific obfuscation patterns in the packer.
## Mitigation Strategies
- **Initial Access Prevention:** Implement robust email filtering to block Qakbot-laden attachments and links.
- **Network Hardening:** Restrict RDP access to VPN-only and implement Multi-Factor Authentication (MFA) across all external-facing services.
- **Privilege Management:** Enforce the principle of least privilege to limit the impact of lateral movement.
- **Backups:** Maintain offline, immutable backups to recover data without paying the ransom.
## Related Tools/Techniques
- **Maze Ransomware:** Predecessor sharing many TTPs.
- **Sekhmet Ransomware:** Shared code similarities.
- **Cobalt Strike:** Primary framework used for post-exploitation.
- **Rclone:** Often used by Egregor affiliates for data exfiltration to cloud storage.