egregor
Active6 claimed victims
The claims below are reproduced as posted by egregor on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Egregor is a ransomware strain that appeared in September 2020, widely believed to be a rebrand or successor to the Maze ransomware operation, using similar infrastructure and tactics. It runs as a Ransomware-as-a-Service (RaaS), recruiting affiliates to deploy its payload in exchange for a percentage of ransom payments. Egregor employs a double-extortion model, encrypting files with ChaCha and RSA-2048 algorithms, while exfiltrating sensitive data to threaten public release. Victims receive ransom notes directing them to Tor-based portals for negotiation.
Description from RansomLook (CC BY 4.0).
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Center Hospitalier de Dax-Côte d’Argent | February 8, 2021 | ransomware_live | — |
| TransLink (Metro Vancouver transit system) | December 1, 2020 | ransomware_live | — |
| Kmart | December 1, 2020 | ransomware_live | — |
| Cencosud | November 13, 2020 | ransomware_live | — |
| SN Servicing Corporation | October 15, 2020 | ransomware_live | — |
| Barnes & Noble | October 10, 2020 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).