Egregor Ransomware Targets Businesses Worldwide
FBI warns of Egregor attacks on business worldwide .The FBI first observed Egregor ransomware in September 2020. To date, the threat actors behind this ransomware variant claim to have compromised over 150 victims worldwide. Once a victim company’s
network is compromised, Egregor actors exfiltrate data and encrypt files on the network. The ransomware leaves a ransom note on machines instructing the victim to communicate with the threat actors via an online chat. Egregor actors often utilize the print function on
victim machines to print ransom notes. The threat actors then demand a ransom payment for the return of exfiltrated files and decryption of the network. If the victim refuses to pay, Egregor publishes victim data to a public site.
What is Egregor
Egregor ransomware is a sophisticated piece of ransomware that first surfaced around September 2020, Egregor has since been involved in a number of high-profile attacks in a short period, including attacks that were launched against major retailers and other organizations.
This ransomware is often distributed as a payload along with remote access trojans (RATs) such as QAKBOT. In turn, QAKBOT has been previously observed to be connected with the MegaCortex and ProLock ransomware families, which indicates either a possible partnership between QAKBOT and Egregor or a new payload from the QAKBOT threat actors.
Threat Overview
Assesses Egregor ransomware is operating as a Ransomware as a Service Model. In this model, multiple different individuals play a part in conducting a single intrusion and ransomware event. Because of the large number of actors involved in deploying Egregor, the tactics, techniques, and procedures (TTPs) used in its deployment can vary widely, creating significant challenges for defense and mitigation.
Egregor ransomware utilizes multiple mechanisms to compromise business networks, including targeting business network and employee personal accounts that share access with business networks or devices. Egregor ransomware may use phishing emails with malicious attachments to gain access to network accounts. Egregor can also exploit Remote Desktop Protocol (RDP) or Virtual Private Networks to gain
access. Adversaries may also leverage Egregor’s RDP exploitation capability to laterally move inside networks. Once Egregor gains access to the network, Egregor ransomware affiliates use common pen testing and exploit tools like Cobalt Strike, Qakbot/Qbot, Advanced IP Scanner, and AdFind to escalate privileges and move laterally across a network, and tools like Rclone (sometimes renamed or hidden as svchost) and 7zip to exfiltrate data.
Recommended Mitigations
Back-up critical data offline.
Ensure copies of critical data are in the cloud or on an external hard drive or storage device.
Secure your back-ups and ensure data is not accessible for modification or deletion from the system where the data resides.
Install and regularly update anti-virus or anti-malware software on all hosts.
Only use secure networks and avoid using public Wi-Fi networks.
Use two-factor authentication and do not click on unsolicited attachments or links in emails.
Prioritize patching of public-facing remote access products and applications, including recent RDP vulnerabilities (CVE-2020-0609, CVE-2020-0610, CVE-2020-16896, CVE-2019- 1489, CVE-2019-1225, CVE-2019-1224, CVE-2019-1108).
Review suspicious .bat and .dll files, files with recon data (such as .log files), and exfiltration tools
Securely configure RDP by restricting access, using multi-factor authentication or strong passwords.
Monitor for Qakbot, Ursnif, and IceID malware infections
Educate all staff on the signs of phishing attacks
Set all anti-virus profiles to block all decoders
Continuously monitor your security posture to strengthen all vulnerabilities.