The Locking Egregor

Egregor is a Big-Game-Hunting ransomware family active since September 2020 that has hit at least 69 companies worldwide; operators use Qakbot for initial access, Cobalt Strike and lateral movement tools (PsExec, AdFind, RDP tweaks) for post-exploitation, and Rclone for data exfiltration before encrypting files with ChaCha8 and RSA-2048. The report includes sample-level malware analysis (DLL delivery via rundll32, multi-layer decryption, obfuscation), observed IoCs (e.g., q.dll, md.exe, RECOVER-FILES.txt, renamed svchost.exe), published data-leak activity, and prioritized detection and mitigation recommendations.