UnknownPublished 4 Jan 2021

OSINT · Egregor RaaS Continues the Chaos with Cobalt Strike and Rclone

Affects type osintSource CIRCL OSINT Feed

TLP:WHITE, disclosure is not limited

Description

OSINT - Egregor RaaS Continues the Chaos with Cobalt Strike and Rclone

Impact

For European organizations, the Egregor ransomware campaign poses a dual threat: operational disruption due to ransomware encryption and reputational and regulatory damage from data breaches caused by exfiltration. Critical sectors such as finance, healthcare, manufacturing, and government entities are particularly vulnerable due to their reliance on continuous availability and sensitive data handling. The use of Cobalt Strike facilitates deep network penetration and lateral movement, increasing the likelihood of widespread compromise within an organization. Rclone's involvement indicates that attackers can bypass traditional perimeter defenses by transferring data to cloud storage, complicating detection and response. The impact extends beyond immediate financial losses from ransom payments to include long-term costs related to data recovery, legal penalties under GDPR, and erosion of customer trust. European organizations with insufficient network segmentation, weak credential management, or inadequate monitoring of cloud data transfers are at heightened risk. The campaign's medium severity suggests that while exploitation is not trivial, the consequences of a successful attack are significant.

Defensive guidance

European organizations should implement advanced network monitoring to detect Cobalt Strike activity, including unusual beaconing patterns and command and control communications. Deploying endpoint detection and response (EDR) solutions capable of identifying suspicious use of tools like Rclone is critical, as is restricting its use to authorized personnel and systems only. Network segmentation should be enforced to limit lateral movement opportunities for attackers. Multi-factor authentication (MFA) must be mandatory for all remote access and privileged accounts to reduce the risk of credential compromise. Regular phishing awareness training can mitigate initial access vectors commonly exploited by ransomware groups. Organizations should maintain offline, immutable backups to ensure recovery without paying ransom. Incident response plans must include procedures for detecting and responding to data exfiltration attempts, including monitoring outbound traffic to cloud storage services. Collaboration with national cybersecurity centers and sharing threat intelligence can enhance preparedness. Finally, applying threat hunting techniques focused on behavioral indicators associated with Egregor's tactics will improve early detection.

Indicators of compromise

URLs 9

http://185.238.0.233/p.dll
http://185.238.0.233/b.dll
http://185.238.0.233/sed.dll
http://185.238.0.233/hnt.dll
http://185.238.0.233/88/k057.exe
http://185.238.0.233/newsvc.zip
http://egregoranrmzapcv.onion
https://egregornews.com/
http://egregor4u5ipdzhv.onion/Payment Portal

IP addresses 5

45.153.242.129
217.8.117.148
45.11.19.70
49.12.104.241On port 81
185.238.0.233

Hashes 76

8483aaf9e1fa5b46486c9f2a14c688c30d2006e88de65d0295a57892de0bf4c9
3fd510a3b2e0b0802d57cd5b1cac1e61797d50a08b87d9b5243becd9e2f7073f
2b3518937fd231560c7dc4f5af672a033b1c810d7f2f82c8151c025ce75775bf
444a6897058fd4965770167b15a2ab13e6fd559a3e6f6cf5565d4d3282587459
c3c50adcc0a5cd2b39677f17fb5f2efca52cc4e47ccd2cdbbf38815d426be9e1
004a2dc3ec7b98fa7fe6ae9c23a8b051ec30bcfcd2bc387c440c07ff5180fe9a
608b5bf065f25cd1c6ac145e3bcdf0b1b6dc742a08e59ec0ce136fe5142774e9
3e5a6834cf6192a987ca9b0b4c8cb9202660e399ebe387af8c7407b12ae2da63
4ea8b8c37cfb02ccdba95fe91c12fb68a2b7174fdcbee7ddaadded8ceb0fdf97
9017c070ad6ac9ac52e361286b3ff24a315f721f488b53b7aaf6ac35de477f44

Link 20

https://labs.sentinelone.com/egregor-raas-continues-the-chaos-with-cobalt-strike-and-rclone/
https://www.virustotal.com/gui/file/9017c070ad6ac9ac52e361286b3ff24a315f721f488b53b7aaf6ac35de477f44/detection/f-9017c070ad6ac9ac52e361286b3ff24a315f721f488b53b7aaf6ac35de477f44-1607607889
https://www.virustotal.com/gui/file/a9d483c0f021b72a94324562068d8164f8cce0aa8f779faea304669390775436/detection/f-a9d483c0f021b72a94324562068d8164f8cce0aa8f779faea304669390775436-1609464195
https://www.virustotal.com/gui/file/8483aaf9e1fa5b46486c9f2a14c688c30d2006e88de65d0295a57892de0bf4c9/detection/f-8483aaf9e1fa5b46486c9f2a14c688c30d2006e88de65d0295a57892de0bf4c9-1608093399
https://www.virustotal.com/gui/file/765327e1dc0888c69c92203d90037c5154db9787f54d3fc8f1097830be8c76ab/detection/f-765327e1dc0888c69c92203d90037c5154db9787f54d3fc8f1097830be8c76ab-1609346253
https://www.virustotal.com/gui/file/608b5bf065f25cd1c6ac145e3bcdf0b1b6dc742a08e59ec0ce136fe5142774e9/detection/f-608b5bf065f25cd1c6ac145e3bcdf0b1b6dc742a08e59ec0ce136fe5142774e9-1608573561
https://www.virustotal.com/gui/file/444a6897058fd4965770167b15a2ab13e6fd559a3e6f6cf5565d4d3282587459/detection/f-444a6897058fd4965770167b15a2ab13e6fd559a3e6f6cf5565d4d3282587459-1608285143
https://www.virustotal.com/gui/file/2b3518937fd231560c7dc4f5af672a033b1c810d7f2f82c8151c025ce75775bf/detection/f-2b3518937fd231560c7dc4f5af672a033b1c810d7f2f82c8151c025ce75775bf-1607457856
https://www.virustotal.com/gui/file/3fd510a3b2e0b0802d57cd5b1cac1e61797d50a08b87d9b5243becd9e2f7073f/detection/f-3fd510a3b2e0b0802d57cd5b1cac1e61797d50a08b87d9b5243becd9e2f7073f-1609359005
https://www.virustotal.com/gui/file/932778732711cd18d5c4aabc507a65180bf1d4bd2b7d2d4e5506be4b8193596e/detection/f-932778732711cd18d5c4aabc507a65180bf1d4bd2b7d2d4e5506be4b8193596e-1607945507

Datetime 19

2020-12-10T13:44:49+00:00
2021-01-01T01:23:15+00:00
2020-12-16T04:36:39+00:00
2020-12-30T16:37:33+00:00
2020-12-21T17:59:21+00:00
2020-12-18T09:52:23+00:00
2020-12-08T20:04:16+00:00
2020-12-30T20:10:05+00:00
2020-12-14T11:31:47+00:00
2020-12-08T20:09:40+00:00

Text 22

59/70
54/70
54/69
55/70
0/59
14/60
60/68
58/69
57/69
55/70

Community reviews

Loading reviews…