The FBI has alerted companies in the private sector to a spate of attacks using the Egregor ransomware. The malware currently is raging a warpath across businesses worldwide and has already compromised more than 150 organizations.
The agency issued an advisory (PDF) that also shed new light and identifies the innerworkings of the prolific malware, which has already been seen wreaking indiscriminate havoc against various types of organizations. Bookseller Barnes & Noble, retailer Kmart, gaming software provider Ubisoft and the Vancouver metro system Translink all are known victims of the ransomware.
Egregor — the name of which refers to an occult term meant to signify the collective energy or force of a group of individuals–is indeed the work of a “large number of actors” and is operating as a ransomware-as-a-service model, according to the FBI.
“Because of the large number of actors involved in deploying Egregor, the tactics, techniques and procedures (TTPs) used in its deployment can vary widely, creating significant challenges for defense and mitigation,” the FBI said.
The FBI noted the ” number of ways” Egregor compromises business networks, “including targeting…employee personal accounts that share access with business networks or devices.” It also spreads via phishing emails with malicious attachments, or exploits for remote desktop protocol (RDP) or VPNs, the agency said.
Once access is gained, threat actors can move laterally inside networks. Egregor ransomware affiliates have been observed using common pen-testing and exploit tools like Cobalt Strike, Qakbot/Qbot, Advanced IP Scanner and AdFind to escalate privileges and make lateral moves across a network, as well as tools like Rclone — sometimes renamed or hidden as “svchost” — and 7zip to exfiltrate data, according to the FBI.
Corroborating what security researchers already have observed, the FBI said it first identified Egregor in September and said that since then, the threat actors behind the malware have worked quickly.
The document also describes what the typical modus operandi of Egregor looks like to victims, behavior also already observed in known and publicized attacks. In addition to engaging in typical ransomware behaviors, such as exfiltrating and encrypting files on the network as well as leaving a ransom note on machines to instruct victims how to communicate with threat actors via an online chat, Egregor also has a unique feature, the FBI noted.
“Egregor actors often utilize the print function on victim machines to print ransom notes,” the agency wrote in the document. Indeed, the group at this time the only known ransomware to run scripts that cause printers at the organization to continuously print out the ransom note, a behavior captured on video and posted to Twitter during an attack on South American retailer Cencosud in mid-November.
If victims refuse to pay, Egregor publishes victim data to a “public site,” the FBI noted. However, the agency—like many security experts–encourages organizations not to pay the ransom, as it “emboldens adversaries to target additional organizations, encourages other criminal actors to engage in the distribution of ransomware, and/or may fund illicit activities,” the agency said.
Paying the ransom also does not guarantee that a victim’s files will be recovered, another well-known outcome of ransomware attacks, the FBI said.
“However, the FBI understands that when businesses are faced with an inability to function, executives will evaluate all options to protect their shareholders, employees and customers,” the agency said, encouraging organizations to report ransomware incidents to their local FBI field offices whether they decide to pay the ransom or not.
Supply-Chain Security: A 10-Point Audit Webinar: Is your company’s software supply-chain prepared for an attack? On Wed., Jan. 20 at 2p.m. ET, start identifying weaknesses in your supply-chain with actionable advice from experts – part of a limited-engagement and LIVE Threatpost webinar. CISOs, AppDev and SysAdmin are invited to ask a panel of A-list cybersecurity experts how they can avoid being caught exposed in a post-SolarWinds-hack world. Attendance is limited: Register Now and reserve a spot for this exclusive Threatpost Supply-Chain Security webinar – Jan. 20, 2 p.m. ET.
