Article
Egregor: The Ghost of Soviet Bears Past Haunts On
Arete Analysis
Combating Ransomware
Threat Actors
Summary
Egregor ransomware, a sophisticated RaaS platform, uses data exfiltration and brazen negotiation tactics to target major sectors like manufacturing and retail and caters to experienced affiliates.
Ransomware variants come. Ransomware variants go. And while Egregor may have only recently surfaced, it is by no means a fly-by-night operation. In fact, one could argue that the foundation upon which Egregor operates has been around since Stalin and Beria’s secret police, and it is been lurking, watching, waiting for the right time to strike.
As a mature and exclusive Ransomware-as-a-Service (RaaS) platform, Egregor poses a serious threat to both public and private organizations. Not only is it supported by seasoned cybercriminal software developers, but it also caters to experienced affiliates who effectively target and compromise organizations, executing enterprise-wide deployment to maximize the monetization of their efforts.
In particular, Egregor plagues the manufacturing and retail sectors, with recent targets including well-known brands like Kmart, TransLink, Embraer, Randstad, Barnes & Noble, and Ubisoft. While the ransomware impacted more than 100 organizations across France, Italy, Germany, the U.K., Asia-Pacific, the Middle East, and Latin America in the final quarter of 2020, U.S. organizations remained top targets, accounting for roughly 50 percent of attacks in that timeframe.
Given the observed consistency of broad, opportunistic targeting, an attack is more a matter of when for organizations that remain unprepared.
Statistical data on Egregor ransomware from Arete metrics
The information listed below is based on Egregor cases investigated by Arete IR since October 2020. Our IR and Data Analytics practices work together to track key data points for every ransomware engagement. Our IR practice tracks data points on the ransomware variant and collects statistics based on handled engagements:
Sectors of clients affected by this threat:
Healthcare | Finance | Professional Services | Manufacturing | Public Service
Malware precursor: Qbot and IcedID
Average ransom demand: $3,407,119
Highest ransom paid: $1,000,000
Lowest ransom paid: $100,000
Average business downtime: 12 days
Data exfiltration has been observed in 99 percent of the cases. In one outlier case, where there was no data exfiltration, Arete assisted the client with data restoration.
From whence the brazen Egregor came
Egregor is a label inspired by the occult, signifying the collective “energy” or “force” of a group of individuals — perhaps befitting an affiliate-serving RaaS platform. It was first publicly identified as early as September 2020, closely following the alleged cessation of Maze ransomware operations the month prior. Both ransomware platforms evolved from the Sehkmet ransomware family, and code analysis of each has provided high-confidence indications that Egregor ransomware is most likely a successor to Maze, whose developers and operators have not ceased operations but merely “re-branded.”
Egregor developers and operator affiliates are likely Russian and/or Eastern European cybercriminals. Security researchers have noted observations of deployment script comments in Russian, and Egregor performs language checks in similar sequence and fashion to its predecessor Maze; it will not execute on systems with a regional designator for Russia or Commonwealth of Independent States (CIS) signatories.
The affiliates operating Egregor are also infamous for their brazen intimidation — for example, allegedly printing ransom demands from victim network printers — and hardline negotiating, executing on the ultimatum that they will leak victim data within 72 hours if they do not receive a response following the encryption of victims’ systems. In many cases, they will leak the entirety of the data they exfiltrate.
Egregor high-level technical overview
While tactics, techniques, and procedures (TTPs) may vary amongst operators, it’s important to note that Egregor caters to semi-exclusive affiliates, likely of Russian or Eastern European origin.
The broader research community has observed consistent commonalities between Egregor and ProLock intrusion cycles. Given their similarities in TTPs, supported by multiple open-source confirmations of our own observations, we assess with high confidence that Qakbot operators have likely transitioned from ProLock to Egregor.
Egregor operators are known to exploit vulnerable and internet-accessible RDP gateways and phish victims with targeted, convincing lures. They also commonly deploy Egregor through Qakbot (Qbot), Ursnif (Gozi/ISFB), IcedID (Bakbot) infostealer/loader hybrid Trojan malware. Cobalt Strike has also been used to deliver Egregor in select instances.
The Egregor payload was likely designed to be portable, serving various affiliate tools, and is commonly encountered as a PE in dynamic linked library (DLL) form. Open-source Intelligence (OSINT) indicates that the DLL contains code and data, natively supporting multiple bot loader functions. The payload will not be decrypted and loaded without the proper key phrase provided to the DLL in the command line.
Egregor operators perform several evasive maneuvers during to the intrusion cycle, including disabling antivirus and endpoint protection (e.g., Windows Defender) via automated scripts (e.g., PowerShell+WMI) executed under elevated privileges.
OSINT reporting reveals that operators have uploaded batch files to victim system that, when executed, will take advantage of the BITSAdmin (bitsadmin.exe) utility to download the ransomware from a remote server and automatically execute it in the system.
The malware supports the following command-line arguments:
–fast: targets files within a size-limit range for encryption
–full: full encryption of the host (including mapped/mounted network drives)
–multiproc: multi-threading for speed
–nomimikatz: switch off Mimikatz module; Mimikatz is an open-source OST credential-harvesting tool
–nonet: do not encrypt network drives
–path: encrypt only specified folder(s)
–target: encrypt file(s) that have a specific extension
–append: select file extension to append to encrypted files
–norename: do not rename encrypted files
–greetings: prepend a name to the ransom note, likely used for directly addressing victims
–samba: establish file-, printer-, and serial port-sharing between compromised nodes
–killrdp: terminate RDP session
During breach response investigations, Arete has observed the following artifacts associated with the ransomware execution:
exe C:%USERNAME%Downloadsclang.dll,DllRegisterServer -pigbutt5 –multiproc
exe \Domain_ControllerIntelmsvc.dll,DllRegisterServer -passegr17 –multiproc
exe C:Windowsmsvc.dll,DllRegisterServer -passegr13 –full
exe C:Windowsdog.dll,DllRegisterServer -pclassified13 –full
exe \Domain_Controllerintelfasm.dll,DllRegisterServer -pbiden17 –multiproc
C:Windowssystem32cmd.exe /c eb2.bat -passegr13
C:Windowssystem32cmd.exe /c eb.bat -pclassified13
The last two artifacts show the threat actor using a batch file to pass the key phrase and properly execute the ransomware with the “–full” option.
The following tools have also been found to be associated with the threat actor activity:
Advanced Port Scanner: A network scanner that enumerates networked hosts and open ports.
ADFind: A tool that is used to enumerate Active Directory.
Lazange: A password recovery tool to harvest credentials.
PsExec: A lightweight tool that lets you execute processes on other systems, complete with full interactivity for console applications, without having to manually install client software.
Security recommendations
Implement a sophisticated endpoint detection and response (EDR) solution that will rely on behavior analysis, instead of just malware signatures, and have tamper-proof capabilities.
Implement multi-factor authentication (MFA).
Implement an email security solution to detect and protect against known and unknown threats.
Lock down and tighten privileges around Microsoft PowerShell in your environment. Apply and enforce PowerShell Constrained Language Mode (CLM) throughout your environments. Consider Just Enough Administration (JEA) policies to allow select PowerShell host administrative capabilities while disabling others.
Hunt for unusual RDP connections.
Prevent users from executing any program or any of the 31 currently known Windows executable filetypes (e.g., .exe, .dll, .hta, .bat, .scr) from the AppDataLocalTemp path of Office365, Microsoft Word, Excel, and Outlook. Alternatively, also inspect C: C:Users[current user]AppDataRoamingMicrosoft as it’s another popular method that achieves the same results.
Develop and implement a user security education program to assist with identifying threats like those in phishing emails.
Implement an off-site backup solution and test it regularly.
Summary of indicators from OSINT and Arete investigations
Egregor filenames
clang.dll | fasm.dll | sed.dll | q.dll |
dog.dll | msvc.dll | b.dll |
Key phrases to decrypt and execute the ransomware
-passgregor10 | -passgregor1313 | -pass2police | -peguard6 | -pclassified13 |
-passengr13 | -passgregor9999 | -pbiden17 | -passengr17 | -websitecounterficker |
Note: ‘dubisteinmutterficker’ is a German profanity: You’re a motherf*****
Bitcoin [BTC] wallet addresses
1MPdDiRhWFawgN2GVi1Jamm8DdC4qypoGL | 112yZpAs3Va6az6JTKZ7iQZEAWdvD5DYoj |
1Mk96FcixjayGZgdPgo4GrnPPSn7rL1jpE | 1D2ZiHwE4pQb8X6NncXdfHwncHa3yrDdYr |
13ELQVGgkM79nW34ncBe7Jz7xhXsXmrRuM | 1PDSGRqkBF7yEjHTNDaxNm6UQT63rrzTGk |
1LdrbQEaersWLi6A83JrCzERyXEZWD4hBP | 1GJ4dp5wwK2E9P74eF7FVujjTHERDTFJX |
1GZV41rSAHAj63pNjLCBwo7rfioxU8JPE9 |
URLs hosting Egregor
hxxp://185.238.0[.]241:81/78.bin | hxxp://49.12.104[.]241:81/sm.dll |
hxxp://49.12.104[.]241/sm.dll | hxxp://49.12.104[.]241:81/78.bin |
Egregor SHA256 hashes
5cb7a352535b447609849e20aec18c84d8b58e377d9c6365eafb45cdb7ef949b 14e547bebaa738b8605ba4182c4379317d121e268f846c0ed3da171375e65fe4 4139c96d16875d1c3d12c27086775437b26d3c0ebdcdc258fb012d23b9ef8345 38b155b6546db882189cc79bcac0b0284d3f858e0feb1e5dbc24b22f78cdfb68 f1ba626b8181bd1cd84f47f70838d9fa4d8117fac3bd07cbd73cb6f73b1297f8 b9b71eb04d255b21e3272eef5f4c15d1c208183748dfad3569efd455d87879c6 6dbe1d2de299359036520f15490834a6ac40b665cf5cd249379d65242af00b44 3b13b6f1d7cd14dc4a097a12e2e505c0a4cff495262261e2bfc991df238b9b04 28f3f5a3ea270d9b896fe38b9df79a6ca430f5edab0423b3d834cf8d586f13e6 7222c8acc69a7598989c335d528b366f801a41b434cbf928c6aef01f8e54f57a a9d483c0f021b72a94324562068d8164f8cce0aa8f779faea304669390775436 14da004cc96b910fb75abb86df09e318d92f4fb8dda39c8bd6a8e0601b6605d8 004a2dc3ec7b98fa7fe6ae9c23a8b051ec30bcfcd2bc387c440c07ff5180fe9a 311baa4d4229a8d6802d82a8d9935592bf9a7b6aaf0949f0fa0b094592f5e8a7 ee06c557f1acd5c4948b1df0413e49f3885f8ac96185a9d986b91a1231444541 2d563dd113a02fdf452544ae2fd7c94162be6db8fb7a287a3474a6ab998159fd 2d01c32d51e4bbb986255e402da4624a61b8ae960532fbb7bb0d3b0080cb9946 9017c070ad6ac9ac52e361286b3ff24a315f721f488b53b7aaf6ac35de477f44 af538ab1b8bdfbf5b7f1548d72c0d042eb14d0011d796cab266f0671720abb4d aee131ba1bfc4b6fa1961a7336e43d667086ebd2c7ff81029e14b2bf47d9f3a7 e6b9d0d356223ed81e635c5702dd47bca1aaeae3471827db03470713e453d5b4 3fc382ae51ceca3ad6ef5880cdd2d89ef508f368911d3cd41c71a54453004c55 319ec80eae65c1d39df27c80b52fe7fe1fadc6e9ceabf72f57d1b29e0467ac02 932778732711cd18d5c4aabc507a65180bf1d4bd2b7d2d4e5506be4b8193596e 3e5a6834cf6192a987ca9b0b4c8cb9202660e399ebe387af8c7407b12ae2da63 3fd510a3b2e0b0802d57cd5b1cac1e61797d50a08b87d9b5243becd9e2f7073f 765327e1dc0888c69c92203d90037c5154db9787f54d3fc8f1097830be8c76ab b027467332243c8186e59f68ff7c43c9e212d9e5074fedf003febcfedad4381a 4c9e3ffda0e663217638e6192a093bbc23cd9ebfbdf6d2fc683f331beaee0321 42ac07c5175d88d6528cfe3dceacd01834323f10c4af98b1a190d5af7a7bb1cb e53ab9a892321f651b73c8468db43b1d82c8c9d7fb8d0131199f501c6a0bafa7 1399e4b4ec1c7f3e38048d526f85472c466421dcd00ecd4515605af191ac61ee 6675c204844476dd8ce59ead0eac082754ded599036551526a8e2c509a1407e4 605c2047be7c4a17823ad1fa5c1f94fd105721fce3621dc9148cd3baf352938e 7fe8d3e63bad6a1628376643a4fe43b9858af5426da808576900b7753bce7614 34c84f171cd6c627d116f9c571b35e11541d68abfce36c852d2d787149f44672 7caed5f406445c788543f55af6d98a8bc4f0c104e6a51e2564dd37b6a485cc18 6a441734b34cdee31a01164140b0c88966fbb4358dcb63a14ae6824f09e9476f 81afd15e8c4d3ae0e34ede646551fe2ed6872d2142f642835cbbbf7dc524131b df5d9251afabd579f85de2f4d0c90150693fa73631317a39d08749d366bf37fd 9c900078cc6061fb7ba038ee5c065a45112665f214361d433fc3906bf288e0eb 967422de1acc14deb7e7ce803d86aff44e2652bfcd550e3a34c2e37abc883dee a7940b9e8ad2a54368999366fe2c50f429008dfb0817000693077e1d1f107d6e c1c4e677b36a2ee6ae858546e727e73cc38c95c9024c724f939178b3c03de906 a5989c480ec6506247325652a1f3cb415934675de3877270ae0f65edd9b14d13 a376fd507afe8a1b5d377d18436e5701702109ac9d3e7026d19b65a7d313b332
Back to Blog Posts
Article
Phishing-as-a-Service Evolves with Venom
“Whaling” has taken on a new meaning with a highly targeted phishing campaign active from November 2025 through March 2026, aimed exclusively at senior executives from more than 20 industries. The campaign, dubbed VENOM, is a phishing-as-a-service (PhaaS) platform that combines advanced evasion capabilities with immediate persistence of targeted executives. The initial phish impersonates an internal SharePoint document notification and uses embedded QR codes to convince victims to shift to unmanaged mobile devices to bypass corporate security controls. VENOM aims to establish persistence immediately by either registering a new MFA device or retaining long-lived refresh tokens, allowing threat actors to maintain access even after password resets or other base-level remediation efforts.
What’s Notable and Unique
This campaign is unique in its targeted nature of the PhaaS platform rather than broad, sweeping attempts. The threat actors behind VENOM create convincing phishing emails that impersonate SharePoint activity using the victim’s own domain, company name, and even fabricated email threads. These convincing social engineering tactics, combined with the specific targeting of executives, make this an effective capability for cybercriminals.
VENOM operates as a closed-access system, with full adversarial support, but has no public visibility on the dark web or from security researchers. The service likely operates on an invite-only basis, unlike most PhaaS platforms, which typically seek to have as many paying customers as possible. This, among other items such as the sophisticated evasion techniques, indicates a higher degree of sophistication than most other PhaaS offerings.
Either through MFA enrollment or Microsoft Device Code abuse, the threat actor forces the victim to aid them in establishing persistence early in the attack lifecycle. These tactics result in either valid tokens or an additional MFA login method controlled by the threat actor, meaning typical password resets alone are not effective against this technique. Administrators would be required to explicitly revoke sessions and token grants to mitigate the threat actors’ persistence.
Analyst Comments
Oftentimes, MFA is viewed as a one-stop shop to cybersecurity, but tactics such as this show how threat actors can bypass MFA, or worse, use it to establish persistence. Ultimately, this campaign highlights how modern attacks increasingly abuse legitimate authentication workflows rather than attempting to defeat them outright. Defenses that rely solely on MFA without other security posturing, such as continuous session monitoring, token revocation, and identity logging, can leave organizations vulnerable. As attackers shift toward token theft and device trust abuse, incident response and identity security strategies must evolve accordingly.
Sources
Meet VENOM: The PhaaS Platform That Neutralizes MFA
Article
Threat Actors Continue to Leverage BYOVD Technique
Multiple ransomware operations have recently been observed leveraging the Bring Your Own Vulnerable Driver (BYOVD) technique to disable endpoint security controls prior to ransomware deployment. Notably, the Qilin ransomware group commonly leverages a malicious msimg32.dll file loaded via DLL side-loading, along with vulnerable drivers including rwdrv.sys and hlpdrv.sys, to gain kernel-level access and disable security processes. Similarly, Warlock ransomware has been observed exploiting the vulnerable NSecKrnl.sys driver to bypass security controls. The use of BYOVD has also been observed across ransomware campaigns associated with Akira, INC, Medusa, and other threat actors.
What’s Notable and Unique
The Qilin ransomware group employs a sophisticated multi-stage infection chain, leveraging DLL side-loading (msimg32.dll) to execute malicious payloads directly in memory and evade traditional file-based detection. In DLL side-loading, a threat actor tricks a program into loading a malicious dynamic link library. The malware escalates privileges and uses signed but vulnerable drivers (rwdrv.sys and hlpdrv.sys) to bypass security controls, access system memory, and systematically disable endpoint defenses by terminating security processes and disabling monitoring callbacks at the kernel level.
Akira ransomware operators have also exploited the rwdrv.sys and hlpdrv.sys drivers. Additionally, Arete has observed threat actors leveraging multiple other drivers, including the vulnerable TrueSight.sys, to bypass security controls.
Meanwhile, Warlock ransomware operators disguised malicious activity by renaming rclone.exe to TrendSecurity.exe to appear legitimate. The file functioned as a loader, exploiting the vulnerable NSecKrnl.sys driver to disable security processes, while Group Policy Objects (GPOs) were leveraged to systematically disable security controls across the environment.
Analyst Comments
The BYOVD technique, employed by multiple known ransomware operators, reflects a broader shift toward pre-encryption defense evasion, including suppression of Windows telemetry, removal of monitoring callbacks, and abuse of legitimately signed but vulnerable drivers. This technique enables threat actors to evade detection, maintain persistence for extended periods, and maximize the operational impact of ransomware deployment across compromised environments. Organizations should implement strict driver control policies, such as Microsoft’s Vulnerable Driver Blocklist and application control mechanisms. Additionally, enforcing least privilege access, enabling multi-factor authentication (MFA), maintaining up-to-date patching, and continuously monitoring for anomalous driver and kernel-level activity can further reduce the risk of such attacks.
Sources
Qilin EDR killer infection chain
Web Shells, Tunnels, and Ransomware: Dissecting a Warlock Attack
Article
Ransomware Trends & Data Insights: March 2026
The threat landscape in March had a much more even distribution of threat groups than has been observed since the first half of 2025. Although Akira, Qilin, Play, and INC remained among the most active groups, Arete observed 21 unique ransomware and extortion groups in March, compared to only 15 in February. Akira and Qilin’s activity also declined from the previous month; in February, the two groups were responsible for almost half of all ransomware incidents, but in March they only comprised a little more than a quarter of all activity. Arete also observed activity from several emerging groups in the past month, including BravoX, NightSpire, Payouts King, and Securotrop.
Figure 1. Activity from the top 5 threat groups in March 2026
Analysts at Arete identified several trends behind the threat actors perpetrating cybercrime activities:
In March, threat actors actively exploited FortiGate Next-Generation Firewall appliances as initial access vectors to compromise enterprise networks. The activity involves the exploitation of recently disclosed security vulnerabilities, including CVE-2025-59718, CVE-2025-59719, and CVE-2026-24858, or weak credentials, allowing attackers to gain administrative access, extract configuration files, and obtain service account credentials. Arete also observed Fortinet device exploitation involving various threat groups, with the Qilin ransomware group notably leveraging Fortinet device exploits.
Phishing campaigns leveraging OAuth redirection and a resurgence of Microsoft Teams–based social engineering were also observed in March. In one campaign, attackers sent emails disguised as Microsoft Teams recordings or Microsoft 365 alerts, redirecting victims through legitimate OAuth endpoints to attacker-controlled pages hosting malicious ZIP payloads. A separate campaign has been ongoing since last year, in which attackers flood users’ inboxes with spam and impersonate IT support personnel to trick victims into initiating remote support sessions via tools like Quick Assist.
Arete recently released its 2025 Annual Crimeware Report. Leveraging data and intelligence collected during ransomware and extortion incident response engagements, this report highlights notable trends and shifts in the threat landscape throughout 2025, including Akira’s unusually high activity levels in the second half of 2025, evolving social engineering techniques, and trends in ransom demands and impacted industries.
Sources
Arete Internal
Report
Arete's 2025 Annual Crimeware Report
Harness Arete’s unique data and expertise on extortion and ransomware to inform your response to the evolving threat landscape.