[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Cybersecurity](/category/cybersecurity) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [What is Egregor Ransomware?](/blog/what-is-egregor-ransomware) Publish date November 30, 2025 {x} minute read # What is Egregor Ransomware? [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/the-ultimate-ransomware-defense-guide) [Free trial](/demo) Written by [Edward Kost](/team/edward-kost) Senior Cybersecurity Writer Edward is a cyber writer with a mechanical engineering background. His work has been referenced by academic institutions and government bodies. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents eBook The Ultimate Ransomware Defense Guide Free resource ### The Ultimate Ransomware Defense Guide [Download now](/resources/the-ultimate-ransomware-defense-guide) Since stepping into the cybercriminal arena in cyber September 2020, the Egregor group has penetrated over 71 businesses globally, including [recruitment giant Randstad](https://www.upguard.com/news/randstad-victim-of-egregor-cyber-attack) and [US retailer Kmart](https://www.upguard.com/news/kmart-servers-breached-in-cyber-attack). But who is the Egregor group and how have they managed to rise up as a significant [cyber threat](https://www.upguard.com/blog/cyber-threat) in just a few short months? ## Who is Egregor? Egregor is a cybercriminal group specializing in a unique branch of [ransomware attacks](https://www.upguard.com/blog/ransomware). Egregor is a term in Western Magic referring to the collective energy of a group of people united with a common purpose. it is speculated that the ransomware operators of notorious cybercrime group Maze, formed Egregor after shutting down their operations in October 2020. Maze's ransomware attack efforts were far-reaching, providing the newly formed Egregor group a prominent platform to springboard from. Egregor earned its destructive reputation after the group successfully breached the Barnes & Noble and video game developers Crytek and Ubisoft in October 2020. In the Barnes & Noble [cyberattack](https://www.upguard.com/blog/cyber-attack), Egregor claimed to have accessed financial and audit information. In an internal email to its customers, Barnes & Noble stated that [customer financial data was not stolen](https://www.publishersweekly.com/pw/by-topic/industry-news/bookselling/article/84619-b-n-systems-hacked.html). The attack also caused temporary outages to Barnes & Noble's Nook e-readers. In the Crytek and Ubisoft cyberattacks, the ransomware gang claimed to have exfiltrated the source codes for upcoming releases including Watchdogs: Legion and Arena of Fate. Egregor published a subset of the stolen data on their website on the [dark web](https://www.upguard.com/blog/dark-web) but the legitimacy of the source code breach was inconclusive. Egregor is one of many cyber threats that have taken advantage of the sudden mass dependency on digital infrastructures brought about by the pandemic. Some of these threats are even specifically targeting the [healthcare sector](https://www.upguard.com/news/cybercriminals-targeting-australian-health-sector), which could have devastating consequences for Covid-19 patients. Egregor operates on a ransomware as a service model. ## What is Ransomware as a Service (Raas)? [Ransomware as a Service (RaaS)](https://www.upguard.com/blog/what-is-ransomware-as-a-service) is an adoption of the Software as a Service model (SaaS). model. Criminal affiliates subscribe to the ransomware software empowering even the most novel hackers to launch devastating and highly-complex ransomware attacks. Because ransomware affiliates are paid prodigious dividends for each successful cyberattack, they are motivated to spread the malicious software, rapidly scaling the ransomware operation over a short period of time. Egregor's swift global expansion is evidence of this successful growth strategy. ## What is Egregor Ransomware? Egregor ransomware is a form of [malware](https://www.upguard.com/blog/malware) that's a modification of both Sekhmet ransomware and Maze ransomware.  There are code similarities across all three ransomware variants, they also all seem to target the same victim demographic.**‍** ****Egregor ransomware attacks are characterized by their brutal, yet highly effective double-extortion tactics. The cybercrime group breaches sensitive data, [encrypting](https://www.upguard.com/blog/encryption) it so that it cannot be accessed by the victim. They then publish a subset of the compromised data on the dark web as proof of the successful exfiltration. The victim is then instructed in a ransom note to pay a set price within 3 days to prevent further personal data from being published on the criminal infested network. If the ransom price is paid before the ultimatum, full decryption of the seized data takes place. ## How Does Egregor Ransomware Work? Egregor ransomware, like all ransomware, is injected into a victim via a loader. This loader and the subsequently installed ransomware undergoes extensive code obfuscation to mitigate static analysis and the [possibility of decryption](https://www.avast.com/en-au/ransomware-decryption-tools). The Egregor payload can only be analyzed by entering the same command line used to run the payload. After a successful breach, the Egregor ransomware manipulates the victim's firewall settings to enable Remote Desktop Protocol (RDP). The software meticulously moves throughout the victim's network, clandestinely identifying and disabling all anti-virus software. With all defenses disarmed, the Egregor ransomware encrypts all of the breached data and inserts a ransom note titled "RECOVER-FILES.txt" into all compromised folders. Victims are instructed to download a dark web browser to communicate with the threat actors via a dedicated landing page on the dark web. ## Egregor Ransomware Threat Mitigation Because Egregor ransomware is a novel threat, cybersecurity experts are still in the process of understanding exactly how the threat operates. The following mitigation suggestions have been garnished from the analysis of security teams to date. * **Monitor for Qakbot, Ursnif, and IceID malware infections**\ \ Commodity [malware](https://www.upguard.com/blog/types-of-malware) such as Qakbot, Ursnif, and IceID have been observed to inject Egregor ransomware as a secondary payload.  If you identify these threats internally, or within your vendor network, immediate remediation is critical.\ ‍ * **Educate all staff on the signs of phishing attacks.**\ \ Phishing attacks are a [common attack vector](https://www.upguard.com/blog/attack-vector) for injecting ransomware. They could create a gateway for Egregor ransomware, or any of its sister payloads - QakBot, Uesnif, and IceID malware.\ \ You should ensure your staff is aware of all the [signs of a phishing attack](https://www.upguard.com/blog/phishing) and a[ clickjacking attack](https://www.upguard.com/blog/what-is-clickjacking). * Set all anti-virus profiles to block all decoders, besides POP3 and IMAP. * Disable all remote access capabilities * Continuously [monitor your security posture](https://www.upguard.com/product/breach-risk) to strengthen all vulnerabilities. * Append an anti-virus profile to all security policies * Implement zone protection policies for all zones * Implement information security policies to all traffic from untrusted sources. * All security policies permitting traffic that contain "Service setting of ANY" should be removed ## Is your business at risk of an Egregor ransomware attack? Egregor is still just a new player in the cybercrime arena. Their initial attacks are already devastating and with such a sophisticated group of threat actors running the dark operation, the worst is still yet to come. At UpGuard we can help you strengthen your security posture to effectively defend against ransomware attacks. Our patented cybersecurity technology also continuously monitors for vulnerabilities with [third-party risk assessment software](https://www.upguard.com/product/vendor-risk/third-party-risk-assessments) from compromised vendors. eBook The Ultimate Ransomware Defense Guide Free resource ### The Ultimate Ransomware Defense Guide [Download now](/resources/the-ultimate-ransomware-defense-guide) ## Related posts Learn more about the latest issues in cybersecurity. Cybersecurity #### [12 Cybersecurity Horror Stories of 2026 (No Costume Required)](/blog/cybersecurity-horror-stories-2026) A warning ignored once becomes a headline. Read more about these 12 real 2026 cybersecurity incidents, and the sign each one gave before it made the news. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Cybersecurity #### [Left Unsupervised: 10 Times Access Outlived Its Authorization](/blog/10-times-access-outlived-authorization) Access granted once shouldn’t mean access forever. Read more on how unmonitored access caused 10 of these real-life breaches and what they taught us. [](/team/revashni-moodley) [Revashni Moodley](#) October 29, 2026 Cybersecurity #### [Surviving a LockBit Ransomware Attack: The ROI of Visibility](/blog/surviving-a-lockbit-ransomware-attack) Read how veteran CISO Nick Gicinto saved his alma mater from a LockBit ransomware attack by discarding the standard playbook. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) June 1, 2026 Cybersecurity #### [Top 10 Security Events of 2025](/blog/top-security-events-of-2025) Recap the ten most impactful events that reshaped the cybersecurity industry this year and the critical lessons each had to teach us. Read more here. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Cybersecurity #### [Risk Automations: The Shift From Catch-Up to Command](/blog/risk-automations-shift-catch-up-to-command) Connect intelligence to system execution with Risk Automations, your new resolution layer for risk. Reduce remediation from hours to seconds - read more. [](/team/revashni-moodley) [Revashni Moodley](#) December 1, 2025 Cybersecurity #### [Shai-Hulud's True Lesson for CISOs: A Crisis of Communication](/blog/shai-hulud-lesson-for-cisos) Shai-Hulud was driven by a communication crisis between security and engineering. Get a CISO's perspective on how to finally bridge this gap. [](/team/phil-ross) [Phil Ross](#) September 3, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)