Operator dossier

egregor is a ransomware operator no longer publishing new disclosures. Darkfield has indexed 6 public victims claimed by this operator between October 10, 2020 and February 8, 2021. Egregor is a ransomware group that emerged in October 2020 and operated with primarily financial motivations, quickly establishing itself as a significant threat in the ransomware landscape. The group is believed to have originated from Russian-speaking cybercriminals and operated as a Ransomware-as-a-Service (RaaS) model, with some researchers suggesting potential connections to the defunct Maze ransomware operation. Egregor employed double extortion tactics, typically gaining initial access through compromised Remote Desktop Protocol (RDP) connections, phishing campaigns, and exploitation of network vulnerabilities, followed by lateral movement using tools like Cobalt Strike before deploying their ransomware payload and exfiltrating sensitive data prior to encryption. The group targeted organizations across multiple sectors including commercial facilities, financial services, transportation systems, and healthcare, with notable victims spanning the United States, Chile, Canada, and France, though specific high-profile attacks received limited public documentation from major security agencies. Egregor's operations were significantly disrupted in early 2021 when international law enforcement actions led to arrests of suspected affiliates, effectively ending the group's activities by mid-2021.

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Inactive ransomware operator

← All groups

egregor

6 victims indexed · first seen 6 years ago · last activity 5 years ago

Victims indexed

#238 of 364 tracked operators

Active period

Oct 2020 → Feb 2021

Countries hit

top US · 3

At a glance

Status: inactive
First seen: 6 years ago
Last activity: 5 years ago
Primary sector: Commercial Facilities · 3 hits

About

Egregor is a ransomware group that emerged in October 2020 and operated with primarily financial motivations, quickly establishing itself as a significant threat in the ransomware landscape. The group is believed to have originated from Russian-speaking cybercriminals and operated as a Ransomware-as-a-Service (RaaS) model, with some researchers suggesting potential connections to the defunct Maze ransomware operation. Egregor employed double extortion tactics, typically gaining initial access through compromised Remote Desktop Protocol (RDP) connections, phishing campaigns, and exploitation of network vulnerabilities, followed by lateral movement using tools like Cobalt Strike before deploying their ransomware payload and exfiltrating sensitive data prior to encryption. The group targeted organizations across multiple sectors including commercial facilities, financial services, transportation systems, and healthcare, with notable victims spanning the United States, Chile, Canada, and France, though specific high-profile attacks received limited public documentation from major security agencies. Egregor's operations were significantly disrupted in early 2021 when international law enforcement actions led to arrests of suspected affiliates, effectively ending the group's activities by mid-2021.

References

8 links

External sources curated by the MISP threat-intel community.

Timeline

4 months

2020-10-01T00:00:00+00:002021-02-01T00:00:00+00:00

Top countries

🇺🇸 United States

🇨🇱 Chile

🇨🇦 Canada

🇫🇷 France

United States dossier →Chile dossier →Canada dossier →France dossier →

Top sectors

Commercial Facilities

Financial

Transportation Systems

Healthcare and Public Health

Commercial Facilities dossier →Financial dossier →Transportation Systems dossier →Healthcare and Public Health dossier →

MITRE ATT&CK

5 techniques · 5 tactics

Tactics

Initial AccessExecutionDefense EvasionExfiltrationImpact

Techniques

T1566Phishing
T1059Command and Scripting Interpreter
T1027Obfuscated Files or Information
T1567Exfiltration Over Web Service
T1486Data Encrypted for Impact

Recent victims

Loading…

Source

Updated 5 years ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time egregor posts a victim.

Add egregor to your watchlist — Pro pings you within 5 minutes of any new egregor leak-site post, Telegram callout, or affiliate-rebrand inference.