Threat Signal ReportEgregor Ransomware Attacks on the RIse - Multiple Organizations Victimized
Description
FortiGuard Labs is aware of a recent spike in malicious Egregor ransomware activity. Egregor (observed distributed via Qakbot) has been linked this week to attacks on U.S. based retailer Kmart and the Vancouver (B.C.) Metro System. It has seen an increase in adoption and activity since the authors of the Maze ransomware decided to retire from the ransomware as a service (RaaS) scene.
Ransomware as a service is nothing new. In 2018, GandCrab was the first of its kind, followed in suit by Maze in 2019. Both the authors of GandCrab and Maze decided to retire from the scene for various reasons unknown to us. Picking up the slack now is Egregor, which was believed to be an offshoot of the Sekhmet Ransomware.
What brought Maze to fame and other copycats to follow was the usage of ransowmare for extortion purposes. In the past, there would be a sum that was asked for, and if the organization didn't pay for it, the bad actor didn't get paid. Maze upped the game by threatening non paying victims that they would end up being blackmailed by releasing confidential exfiltrated data to the public.
Following the retirement of Maze, Egregor has copied the business model of blackmail. Feeling the pressure, along with the potential of a PR disaster, an organization with a lot to lose might simply pay the ransom. It appears that the threat actors behind Egregor are not randomly targeting individuals, small business and organizations randomly, but choosing organizations that are well known to the public.
What Operating Systems are Affected?
Windows based operating systems.
How Serious of an Issue is This?
HIGH. This is due to the disruption to day to day operations of an organization targeted by Egregor, or any ransomware variant. This is especially important for organizations that provide critical care and ambulatory care services such as hospitals, first responders, etc. that cannot afford a disruption in day to day operations.
Should Victims Pay the Ransom?
There are the reasons why paying a ransom might not be a good idea, including the legality, and it was initially suggested not to the pay the ransom. However, it is up to each organization to determine risk, the potential for loss due to downtime and reputation, along whether or not an organization has cybersecurity insurance coverage to help mitigate such potential losses.
What is the Status of Coverage?
FortiGuard Labs has the following AV coverage in place for Egregor Ransomware and variants in place as:
W32/Egregor.HEDE!tr
W32/Egregor.D!tr
W32/Egregor.HGLU!tr
W32/Generic.EGREGOR!tr
W32/Filecoder_Egregor.D!tr
W32/Agent.BFPD!tr
W32/GenKryptik.DJNF!tr
W32/GenKryptik.DQHN!tr
W32/Kryptik.GZNI!tr
W32/GenKryptik.CNAR!tr
W32/Kryptik.GICH!tr
W32/Agent.TJS!tr
W32/Agent.APVC!tr.dldr
W32/Agent.NLP!worm
W32/Naglov.OA!tr
W32/Virlock.J
W32/GenKryptik.APXF!tr
Any Other Suggested Mitigation?
Due to the ease of disruption and potential for damage to daily operations, reputation, and unwanted release of personally identifiable information (PII), etc., it is important to keep all AV and IPS signatures up to date. It is also important to ensure that all known vendor vulnerabilities within an organization are addressed, and updated to protect from attackers establishing a foothold within a network.
Also - organizations are encouraged to conduct ongoing training sessions to educate and inform personnel about the latest phishing/spearphishing attacks. They also need to encourage employees to never open attachments from someone they don't know, and to always treat emails from unrecognized/untrusted senders with caution. Since it has been reported that various phishing and spearphishing attacks have been delivered via social engineering distribution mechanisms, it is crucial that end users within an organization be made aware of the various types of attacks being delivered. This can be accomplished through regular training sessions and impromptu tests using predetermined templates by an organizations' internal security department. Simple user awareness training on how to spot emails with malicious attachments or links could also help prevent initial access into the network.
