Quick Hits

Meet 'Egregor,' a New Ransomware Family to Watch

Egregor's operators promise to decrypt victims' files and provide security recommendations in exchange for ransom payment.

Researchers have been analyzing a new ransomware family that calls itself "Egregor." Attackers behind the malware, which has affected at least 13 companies, typically operate by breaking into organizations, stealing sensitive data, and running the malware to encrypt their files.

Related Content:

US Treasury Warns of Sanctions Violations for Paying Ransomware Attackers

State of Endpoint Security: How Enterprises Are Managing Endpoint Security Threats

New on The Edge: CFAA 101: A Computer Fraud & Abuse Act Primer for InfoSec Pros

Appgate researchers tracking the threat say it contains anti-analysis techniques such as code obfuscation and packed payloads. In one of its execution stages, they found, the payload can only be decrypted if the proper key is entered in the process's command line. This means the file can't be analyzed unless someone enters the same command line used to run the payload.

Egregor's ransom note promises that if the ransom is not paid within three days, the attackers will leak part of the stolen data and alert the victim company's partners and clients via mass media so they know of the breach.

If ransom is paid, Egregor's operators claim they will decrypt the files and provide recommendations for securing the company's network to avoid future attacks, "acting as some sort of black hat pentest team," the researchers write. 

Read more details in Appgate's full blog post.

Editors' Choice
Jeffrey Schwartz, Contributing Writer, Dark Reading
Jai Vijayan, Contributing Writer, Dark Reading