egregor

Egregor is a ransomware group that emerged in October 2020 and operated with primarily financial motivations, quickly establishing itself as a significant threat in the ransomware landscape. The group is believed to have originated from Russian-speaking cybercriminals and operated as a Ransomware-as-a-Service (RaaS) model, with some researchers suggesting potential connections to the defunct Maze ransomware operation. Egregor employed double extortion tactics, typically gaining initial access through compromised Remote Desktop Protocol (RDP) connections, phishing campaigns, and exploitation of network vulnerabilities, followed by lateral movement using tools like Cobalt Strike before deploying their ransomware payload and exfiltrating sensitive data prior to encryption. The group targeted organizations across multiple sectors including commercial facilities, financial services, transportation systems, and healthcare, with notable victims spanning the United States, Chile, Canada, and France, though specific high-profile attacks received limited public documentation from major security agencies. Egregor's operations were significantly disrupted in early 2021 when international law enforcement actions led to arrests of suspected affiliates, effectively ending the group's activities by mid-2021.