Accessibility Options |  Sitemap |  Contact Us
   
 
 
 
HOME space ABOUTCERTIn space KNOWLEDGEBASE space TRAINING space ADVISORIES space VULNOTES space space Facebook space x space insta space youtube space Linkedin
WLine
DigitalIndia
WLine
csk
WLine
Full Member FIRST
Line
Operational Member TFCSIRT
Line
Accredited Member APCERT
Line
Global Research Partner APWG
Line
Associate Partner Charter
Line
CNA
WLine
 Directions by CERT-In under  Section 70B, Information  Technology Act 2000
WLine
 Guidelines on Information  Security Practices for  Government Entities
WLine
 15 Elemental Cyber NEW
 Defense Controls for Micro,
 Small, and Medium Enterprises
 (MSMEs)
WLine
 Technical Guidelines on NEW  SBOM, QBOM & CBOM, AIBOM
 and HBOM Version 2.0
WLine
 Cyber Security GuidelinesNEW
 for Smart City Infrastructure
About CERT-in
Line
point point Client's /Citizen's Charter
Line
point point Roles & Functions
Line
point point Advisory Committee
Line
point point Act/Rules/Regulations
Line
point point Internal Complaint Committee         (ICC) 
Line
point point RFC2350 
line
point point Press  
Line
point point Tender 
Line
point point Subscribe Mailing List
Line
point point Contact Us
Line
Line
Reporting
point
 Incident Reporting
point
Line
point
 Vulnerability Reporting
point
Line
point
 Feedback
point
Line
KnowledgeBase
Line
point Point Guidelines
Line
point Point Presentations
Line
point Point White Papers 
Line
point Point Annual Report 
Line
Line
Line
line
Line
line
line
Advisories
Line
VulnerabilityNotes
Line
RelatedLinks
Line
point Point World CERTs
Line
point point Antivirus Resources
line
point point FAQ
line
line
Line
Line
line
line
line
line
line
line
line
line
line
line
line
line
line
line
line
line
line
line
line
line
line
line
spacer
Home - Virus AlertsPrint
point

VIRUS ALERTS

Egregor Ransomware

Original Issue Date:October 28, 2020

Virus Type: Ransomware

It has been reported that a new ransomware, named as Egregor is affecting organizations globally. The modus operandi used is typically breaking into organizations, stealing sensitive data, and running the malware to encrypt their files and threatens "Mass-Media" Release of Corporate Data if ransom not paid in due time. It uses double extortion tactics generally used by NetWalker ransomware families.

Initial Infection vector and propagation mechanism is still unknown, it is anticipated that Egregor ransomware may infiltration via spam email attachments or maliciously crafted link shared via email/instant messaging chats.

It uses several types of anti-analysis techniques, including code obfuscation and packed payloads, which means the malicious code "unpacks" itself in memory as a way to avoid detection by security tools. The ransomware will not exhibit is functionalities while analysing it until if the exact same command line that the attackers used to run the ransomware. This make difficult for analyst to analyse samples manually or in sanbox environment.

It appends a string or random characters as the new extension of each encrypted file and creates the "RECOVER-FILES.txt" text file/ransom note in all folders that contain encrypted files. Content of "RECOVER-FILES.txt" is shown below:

Below is the screenshot of the Egregor ransomware website.

Various similarities found between Sekhmet and Egregor ransomware samples, like the obfuscation techniques, functions, API calls and strings, such as %Greetings2target% and %sekhmet_data% changing to %egregor_data%. The ransom note left on affected system is also familiar.

Countermeasures and Best practices for prevention:

Users and administrators are advised to take the following preventive measures to protect their computer networks from ransomware infection/ attacks:
  • Perform regular backups of all critical information to limit the impact of data or system loss and to help expedite the recovery process. Ideally, this data should be kept on a separate device, and backups should be stored offline.
  • Check regularly for the integrity of the information stored in the databases.
  • Regularly check the contents of backup files of databases for any unauthorized encrypted contents of data records or external elements, (backdoors /malicious scripts.)
  • Ensure integrity of the codes /scripts being used in database, authentication and sensitive systems
  • Establish Domain-based Message Authentication, Reporting, and Conformance (DMARC), DomainKeys Identified Mail (DKIM) and Sender Policy Framework (SPF) for your domain, which is an email validation system designed to prevent spam by detecting email spoofing by which most of the ransomware samples successfully reaches the corporate email boxes.
  • Keep the operating system third party applications (MS office, browsers, browser Plugins) up-to-date with the latest patches.
  • Application white listing/Strict implementation of Software Restriction Policies (SRP)to block binaries running from %APPDATA% and %TEMP% paths. Ransomware sample drops and executes generally from these locations.
  • Maintain updated Antivirus software on all systems
  • Don't open attachments in unsolicited e-mails, even if they come from people in your contact list, and never click on a URL contained in an unsolicited e-mail, even if the link seems benign. In cases of genuine URLs close out the e-mail and go to the organization's website directly through browser
  • Follow safe practices when browsing the web. Ensure the web browsers are secured enough with appropriate content controls.
  • Network segmentation and segregation into security zones - help protect sensitive information and critical services. Separate administrative network from business processes with physical controls and Virtual Local Area Networks.
  • Disable ActiveX content in Microsoft Office applications such as Word, Excel, etc.
  • Disable remote Desktop Connections, employ least-privileged accounts. Limit users who can log in using Remote Desktop, set an account lockout policy. Ensure proper RDP logging and configuration.
  • Restrict access using firewalls and allow only to selected remote endpoints, VPN may also be used with dedicated pool for RDP access
  • Use strong authentication protocol, such as Network Level Authentication (NLA) in Windows.
  • Additional Security measures that may be considered are
    • Use RDP Gateways for better management
    • Change the listening port for Remote Desktop
    • Tunnel Remote Desktop connections through IPSec or SSH
    • Two-factor authentication may also be considered for highly critical systems
  • If not required consider disabling, PowerShell / windows script hosting.
  • Restrict users' abilities (permissions) to install and run unwanted software applications.
  • Enable personal firewalls on workstations.
  • Implement strict External Device (USB drive) usage policy.
  • Employ data-at-rest and data-in-transit encryption.
  • Consider installing Enhanced Mitigation Experience Toolkit, or similar host-level anti-exploitation tools.
  • Block the attachments of file types, exe|pif|tmp|url|vb|vbe|scr|reg|cer|pst|cmd|com|bat|dll|dat|hlp|hta|js|wsf
  • Carry out vulnerability Assessment and Penetration Testing (VAPT) and information security audit of critical networks/systems, especially database servers from CERT-IN empanelled auditors. Repeat audits at regular intervals.
  • Individuals or organizations are not encouraged to pay the ransom, as this does not guarantee files will be released. Report such instances of fraud to CERT-In and Law Enforcement agencies

References

https://www.appgate.com/news-press/appgate-labs-analyzes-new-family-of-ransomware-egregor
https://www.bankinfosecurity.com/egregor-ransomware-adds-to-data-leak-trend-a-15110
https://threatpost.com/egregor-ransomware-mass-media-corporate-data/159816/
https://www.CyberSwachhtaKendra.gov.in/alerts/ransomware.html

 

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email:info@cert-in.org.in
Phone: +91-11-22902657
Postal Address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
Indian Computer Emergency Response Team - CERT-In, Ministry of Electronics and Information Technology, Government of India.
Website Policies |  Terms of Use |  Help Last Updated On November 01, 2025