Egregor Awakens: Taking a Tour of a Threat Action New Digs
summary
Egregor emerges September 2020 as a Sekhmet-related RaaS that claims 206 victims by year end, uses phishing, RDP/VPN exploits and Cobalt Strike, and stages payloads with a ChaCha-based first packer, a second-stage Rabbit cipher decryption that requires a runtime password, then a final obfuscated encryptor that deletes shadow copies, stops backup services and even floods printers with a printer ransom note. Infrastructure goes dark after mid‑Feb 2021 arrests, but affiliates and TTPs (7‑Zip exfil, varied packers) persist and migrate to new operations.
AI-written summary · about
chapters (8)
- 0:00Introduction and background
- 1:06Egregor threat actor overview
- 8:05Ransomware attack stages
- 12:16Egregor ransomware payload
- 21:11Differences from Sekhmet ransomware
- 25:25Tracking ransomware threat actors
- 30:21Future of Egregor and ransomware
- 33:14Q&A session
related talks
27mFrom RATs to Extorting Multibillion Companies: The Evolution of a Modern Ransomware Group
37mRansomware Resilience: Holistic Defense for SOC Leaders
10mBehind the Next Destructive Attack
52mRansomware 101: Get Smart Understanding Real Attacks
42mStart Covering Your Bases And Stop Chasing APT Headlines
19mOperation PZCHAO
40mRansomware Threat Landscape
32mSurviving a Ransomware Attack - Lessons from the Field