Egregor Ransomware
RaaS double extortion
Source Attribution
- Origin
- MITRE
- Source
- Manufacturer reports
- Verified
- 2026-08-26T16:07:01.550Z
- Confidence
- high
Source: Manufacturer reports · Verified: 2026-08-26T16:07:01.550Z · Confidence: high
Security Timeline
- discovered Egregor Ransomware first observed
- updated Encyclopedia entry reviewed (Phase 45C)
Quick Answer
Egregor was a RaaS that operated double extortion before arrests in early 2021. (attributes recorded from Manufacturer reports).
Definition
Egregor was a RaaS that operated double extortion before arrests in early 2021.
Overview
Egregor was a RaaS that operated double extortion before arrests in early 2021.
Behavior
- RDP/PsExec deployment
- leak site
- later takedown
First Seen
2020-09
Target
RaaS double extortion
Malware Intelligence
Family: Egregor Ransomware
Techniques: T1486, T1567
Targets: RaaS double extortion
Behavior:
- RDP/PsExec deployment
- leak site
- later takedown
References
Have a follow-up question?
Ask AI about this Start an investigation Ask OpenTrojan's evidence-backed assistant about this topic — answers cite their sources.