Palo Alto creates visualization tool to guide response to Egregor ransomware attacks

The FBI’s Cyber Division sales opportunities the nation’s endeavours to look into and prosecute internet crimes. Since it was initial uncovered in September 2020, Egregor has hit various industries globally, which includes those in just the U.S., Europe, Asia Pacific and Latin The usa. (FBI)

The recent surge in Egregor ransomware action influenced Palo Alto’s Unit 42 to create a complete visualization of the procedures applied by the attack group and the suitable classes of motion security groups can acquire to react.

In the Unit 42 ATOM Viewer, security professionals can check out in a desk what tactics the attackers applied, then simply click on a chart to see what to allow on a Palo Alto firewall. Organizations that really do not use Palo Alto firewalls can map the info from the Viewer to the MITRE ATT&CK framework.

Jen Miller-Osborn, deputy director of risk intelligence at Device 42, reported corporations should also be conscious of and monitor the use of commodity malware such as Qakbot, IcedID and Ursnif that could close up delivering Egregor ransomware as a 2nd-stage payload.

And given that Egregor statements to provide stolen info if ransoms are not compensated, Gallagher said it’s not enough to merely have excellent backups.

“Organizations will need to presume that their information has been breached if they endure an Egregor or any other ransomware attack,” he said. “Blocking frequent exfiltration routes for data – these types of as preventing Tor connections – can make thieving facts extra tricky, but the best protection is to deny attackers obtain by way of email attachment malware and other frequent entry factors.”

Considering that it was very first learned in September 2020, Egregor has strike several industries globally, such as those in the U.S., Europe, Asia Pacific and Latin The us. In North The usa, some of Egregor’s a lot more large-profile attacks have included  Barnes and Noble, Kmart and even led to a shutdown of the Vancouver metro previous week.

Egregor retains a lot of similarities to the supposedly shutdown Maze strain, in party because the two ended up derived from the Sekhmet ransomware relatives. That is led to some discussion in just the analysis group about no matter if they are in point on in the exact. Miller-Osborn claimed although affiliate marketers who utilized the Maze ransomware to conduct their routines now appear to have most likely moved on to Egregor to avoid disrupting their functions, there is no definitive evidence that the Maze gang just reformed as Egregor.

Some areas of this post are sourced from:
www.scmagazine.com