Egregor Ransomware is targeting companies worldwide through its ransomware-as-a-service program. It has multiple means to compromise a target, including RDP exploits (mainly brute-force) and through phishing emails. It was also discovered that the malware will utilize Cobalt Strike beacon payload into the system after compromising the target to ensure persistence while also delivering and launching the Egregor payloads. The payloads for the Egregor ransomware are highly obfuscated via encrypting the payload in a combination of the ChaCha stream cipher and RSA encryption algorithm. Another feature of Egregor ransomware is the payloads will check for the primary device language used in the system, and will avoid encrypting the systems if the language is Russian, and a few others languages of the neighboring countries. The ransomware will also exfiltrate the data from the system prior to encrypting the system using an open source utility called Rclone.
There have been reports of Egregor utilizing CVE-2020-0688 (a remote code execution flaw in Microsoft Exchange). Some sources also report the possible exploitation of CVE-2018-8174 (VBScript Engine), CVE-2018-4878 (Adobe Flash Player) & CVE-2018-15982 (Adobe Flash Player). They have also been shown to use LOTL (Living off the Land) tools such as bitsadmin to download or update DLL components. In addition, some larger malware families and frameworks such as QBot have been observed distributing Egregor in recent campaigns.