Egregor
Attribution profile
- Type
- Crime Syndicate
- Location
- Russia
- Known incidents
- 22 incidents
- Sources
- 14 sources
- First seen
- 2020-02-29
- Last seen
- 2021-02-24
- Updated
- 2026-10-10 22:02
- Aliases
- 1 alias
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
Egregor, also known as the Egregor ransomware group, is a cybercriminal operation believed to be based in Russia. It has conducted ransomware attacks that extort payment by encrypting files and threatening to leak stolen unencrypted data, operating as a ransomware‑as‑a‑service where affiliates receive a share of ransom payments. The group has also carried out disruptive operations, including a supply‑chain compromise of Ukraine’s government document management system using malicious Office documents with macros to install remote‑access malware and subsequent DDoS attacks launched from Russian‑controlled infrastructure after infecting vulnerable servers with botnet‑forming malware. Its tactics involve leveraging affiliates previously associated with the Maze ransomware operation. Notable publicly reported campaigns include ransomware incidents against the staffing firm Randstad, retailer Kmart, Vancouver’s TransLink transit agency, healthcare providers such as Coldwater Orthodontics and Delta Dental, game developers Crytek and Ubisoft, and retail chains Cencosud and Barnes & Noble, as well as the February 2021 Ukrainian government supply‑chain and DDoS activity.
Incidents
Attributed incidents are available to members.
22 incidentsSources
Sources available to members: 14 sources.