FBI WARNS OF EGREGOR RANSOMWARE EXTORTING BUSINESSES WORLDWIDE
The US Federal Bureau of Investigation (FBI) has sent a security alert warning private sector companies that the Egregor ransomware operation is actively targeting and extorting businesses worldwide.
The FBI says in a TLP:WHITE Private Industry Notification (PIN) shared on Wednesday that Egregor claims to have already hit and compromised more than over 150 victims since the agency first observed this malicious activity in September 2020.
"Because of the large number of actors involved in deploying Egregor, the tactics, techniques, and procedures (TTPs) used in its deployment can vary widely, creating significant challenges for defense and mitigation," the US intelligence and security service says.
"Egregor ransomware utilizes multiple mechanisms to compromise business networks, including targeting business network and employee personal accounts that share access with business networks or devices."
Phishing emails with malicious attachments and insecure Remote Desktop Protocol(RDP) or Virtual Private Networks are some of the attack vectors used by Egregor actors to gain access and to move laterally within their victims' networks.
Egregor uses Cobalt Strike, Qakbot/Qbot, Advanced IP Scanner, and AdFind for privilege escalation and lateral network movement.
Affiliates are also using 7zip and Rclone, at times camouflaged as a Service Host Process (svchost) process, for data exfiltration before deploying the ransomware payloads on the victims' network.
The FBI also shared a list of recommended mitigation measures that should help defend against Egregor's attacks:
- Back-up critical data offline.
- Ensure copies of critical data are in the cloud or on an external hard drive or storage device.
- Secure your back-ups and ensure data is not accessible for modification or deletion from the system where the data resides.
- Install and regularly update anti-virus or anti-malware software on all hosts.
- Only use secure networks and avoid using public Wi-Fi networks.
- Use two-factor authentication and do not click on unsolicited attachments or links in emails.
- Prioritize patching of public-facing remote access products and applications, including recent RDP vulnerabilities (CVE-2020-0609, CVE-2020-0610, CVE-2020-16896, CVE-2019-1489, CVE-2019-1225, CVE-2019-1224, CVE-2019-1108).
- Review suspicious .bat and .dll files, files with recon data (such as .log files), and exfiltration tools.
- Securely configure RDP by restricting access, using multi-factor authentication or strong passwords.
RaaS operation with former Maze affiliates as partners
Egregor is a Ransomware as a Service operation that partners with affiliates who hack networks to deploy ransomware payloads, distributing the ransom payment earnings with the Egregor operators using a 70/30 split.
After infiltrating the victims' networks they also steal files before encrypting devices and use them as leverage under the threat of publicly leaking the stolen data if the ransom is not paid.Egregor started operating after Maze shut down their operation, with many of the Maze affiliates immediately switching to Egregor's RaaS as BleepingComputer was told by threat actors.
Since September, Egregor affiliates have breached and encrypted the systems of multiple high-profile organizations including but not limited to Ubisoft, Kmart, Randstad, Barnes and Noble, Cencosud, Crytek, and Metro Vancouver's transportation agency TransLink.
Para el ver artículo original: https://www.bleepingcomputer.com/news/security/fbi-warns-of-egregor-ransomware-extorting-businesses-worldwide/
Últimos Artículos
