Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
High
Egregor Ransomware is targeting companies worldwide through its ransomware-as-a-service program. It has multiple means to compromise a target, including RDP exploits (mainly brute-force) and through phishing emails. It was also discovered that the malware will utilize Cobalt Strike beacon payload into the system after compromising the target to ensure persistence while also delivering and launching the Egregor payloads. The payloads for the Egregor ransomware are highly obfuscated via encrypting the payload in a combination of the ChaCha stream cipher and RSA encryption algorithm. Another feature of Egregor ransomware is the payloads will check for the primary device language used in the system, and will avoid encrypting the systems if the language is Russian, and a few others languages of the neighboring countries. The ransomware will also exfiltrate the data from the system prior to encrypting the system using an open source utility called Rclone.
There have been reports of Egregor utilizing CVE-2020-0688 (a remote code execution flaw in Microsoft Exchange). Some sources also report the possible exploitation of CVE-2018-8174 (VBScript Engine), CVE-2018-4878 (Adobe Flash Player) & CVE-2018-15982 (Adobe Flash Player). They have also been shown to use LOTL (Living off the Land) tools such as bitsadmin to download or update DLL components. In addition, some larger malware families and frameworks such as QBot have been observed distributing Egregor in recent campaigns.