Egregor — the name of which refers to an occult term meant to signify the collective energy or force of a group of individuals–is indeed the work of a “large number of actors” and is operating as a ransomware-as-a-service model, according to the FBI.
“Because of the large number of actors involved in deploying Egregor, the tactics, techniques and procedures (TTPs) used in its deployment can vary widely, creating significant challenges for defense and mitigation,” the FBI said.
The FBI noted the ” number of ways” Egregor compromises business networks, “including targeting…employee personal accounts that share access with business networks or devices.” It also spreads via phishing emails with malicious attachments, or exploits for remote desktop protocol (RDP) or VPNs, the agency said.
Once access is gained, threat actors can move laterally inside networks. Egregor ransomware affiliates have been observed using common pen-testing and exploit tools like Cobalt Strike, Qakbot/Qbot, Advanced IP Scanner and AdFind to escalate privileges and make lateral moves across a network, as well as tools like Rclone — sometimes renamed or hidden as “svchost” — and 7zip to exfiltrate data, according to the FBI.
Corroborating what security researchers already have observed, the FBI said it first identified Egregor in September and said that since then, the threat actors behind the malware have worked quickly.
The document also describes what the typical modus operandi of Egregor looks like to victims, behavior also already observed in known and publicized attacks. In addition to engaging in typical ransomware behaviors, such as exfiltrating and encrypting files on the network as well as leaving a ransom note on machines to instruct victims how to communicate with threat actors via an online chat, Egregor also has a unique feature, the FBI noted.
“Egregor actors often utilize the print function on victim machines to print ransom notes,” the agency wrote in the document. Indeed, the group at this time the only known ransomware to run scripts that cause printers at the organization to continuously print out the ransom note, a behavior captured on video and posted to Twitter during an attack on South American retailer Cencosud in mid-November.
If victims refuse to pay, Egregor publishes victim data to a “public site,” the FBI noted. However, the agency—like many security experts–encourages organizations not to pay the ransom, as it “emboldens adversaries to target additional organizations, encourages other criminal actors to engage in the distribution of ransomware, and/or may fund illicit activities,” the agency said.
Paying the ransom also does not guarantee that a victim’s files will be recovered, another well-known outcome of ransomware attacks, the FBI said.
“However, the FBI understands that when businesses are faced with an inability to function, executives will evaluate all options to protect their shareholders, employees and customers,” the agency said, encouraging organizations to report ransomware incidents to their local FBI field offices whether they decide to pay the ransom or not.
Author: Elizabeth Montalbano
