Egregor
Software · ATTACK:enterprise:S0554
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0554",
"title": "Egregor",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0554",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--cc4c1287-9c86-4447-810c-744f3880ec37",
"external_id": "S0554",
"domain": "enterprise",
"created": "2020-12-29T21:32:27.939Z",
"modified": "2025-04-25T14:44:43.318Z",
"version": "1.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Egregor"
},
{
"source_name": "NHS Digital Egregor Nov 2020",
"url": "https://digital.nhs.uk/cyber-alerts/2020/cc-3681#summary"
},
{
"source_name": "Cyble Egregor Oct 2020",
"url": "https://cybleinc.com/2020/10/31/egregor-ransomware-a-deep-dive-into-its-activities-and-techniques/"
},
{
"source_name": "Security Boulevard Egregor Oct 2020",
"url": "https://securityboulevard.com/2020/10/egregor-sekhmets-cousin/"
}
]
}Explicit source assertions (25)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0554 → uses → ATTACK:enterprise:T1497.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1492575f-9e3d-4ba0-ae2d-66711120adf6
JoeSecurity Egregor 2020ATTACK:enterprise:S0554 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--218617ce-6474-4fd4-920e-88207c5aa219
Cybereason Egregor Nov 2020ATTACK:enterprise:S0554 → uses → ATTACK:enterprise:T1197
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--35e66e21-edaf-46ed-8cec-32ba4ce92aa4
Intrinsec Egregor Nov 2020ATTACK:enterprise:S0554 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4467fb1b-60fe-4e13-a32a-8c1f60a66782
JoeSecurity Egregor 2020ATTACK:enterprise:S0554 → uses → ATTACK:enterprise:T1027.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--552c3e40-dbb9-4675-bc31-5436a15253d8
NHS Digital Egregor Nov 2020 · Cyble Egregor Oct 2020ATTACK:enterprise:S0554 → uses → ATTACK:enterprise:T1039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--59c58c73-046c-4e01-9ced-8c049381fcd2
NHS Digital Egregor Nov 2020ATTACK:enterprise:S0554 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5bcec016-2150-4c45-9e9b-228838c9e843
Cyble Egregor Oct 2020ATTACK:enterprise:S0554 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--66044dfc-ab9a-4de4-a20b-cfed6d3f6236
NHS Digital Egregor Nov 2020 · Cybereason Egregor Nov 2020ATTACK:enterprise:S0554 → uses → ATTACK:enterprise:T1036.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6c6a8e6f-3340-4cd7-8abb-c39c408440f1
Intrinsec Egregor Nov 2020ATTACK:enterprise:S0554 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--783b7e83-90ee-4628-80a5-c087258290ab
NHS Digital Egregor Nov 2020ATTACK:enterprise:S0554 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--830b40b0-ffc8-4847-8849-27b62c9e84b6
Intrinsec Egregor Nov 2020ATTACK:enterprise:S0554 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--87182fef-ddbc-466e-b55b-989f10592d0c
Cybereason Egregor Nov 2020 · Intrinsec Egregor Nov 2020ATTACK:enterprise:S0554 → uses → ATTACK:enterprise:T1685
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--87a43445-69cd-46d6-b164-3ed1b1221bda
Intrinsec Egregor Nov 2020ATTACK:enterprise:S0554 → uses → ATTACK:enterprise:T1497
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--89ef773b-6d5d-482e-9afd-bc892eb8093e
Cyble Egregor Oct 2020 · NHS Digital Egregor Nov 2020ATTACK:enterprise:S0554 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9eaf89d5-01aa-4758-a2a9-abac83d2a17e
Cyble Egregor Oct 2020ATTACK:enterprise:S0554 → uses → ATTACK:enterprise:T1486
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a3eb4cec-8053-4830-b256-e46748dba3d9
NHS Digital Egregor Nov 2020 · Cybereason Egregor Nov 2020ATTACK:enterprise:S0554 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--afeb1494-e640-410c-8e81-62970e22f8a7
Intrinsec Egregor Nov 2020ATTACK:enterprise:S0554 → uses → ATTACK:enterprise:T1218.010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b3cb9975-adb2-422c-a8b3-0b1ea230d4e4
JoeSecurity Egregor 2020ATTACK:enterprise:S0554 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c18699a3-915b-4c5f-b81a-a248cb558aaa
Intrinsec Egregor Nov 2020ATTACK:enterprise:S0554 → uses → ATTACK:enterprise:T1219
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--de071e4d-eee7-4ad5-96b6-fe83bfe3e25a
Cyble Egregor Oct 2020ATTACK:enterprise:S0554 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e5080d8c-37e3-4a64-8983-f92356850c99
JoeSecurity Egregor 2020 · Cybereason Egregor Nov 2020ATTACK:enterprise:S0554 → uses → ATTACK:enterprise:T1484.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e50d74be-2705-4937-9bd9-7b0913901e27
Cybereason Egregor Nov 2020 · Intrinsec Egregor Nov 2020ATTACK:enterprise:S0554 → uses → ATTACK:enterprise:T1055
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e88d0a1d-9861-4260-b030-dd80e81d179a
Cyble Egregor Oct 2020ATTACK:enterprise:S0554 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eddcfbbf-9e82-4029-87fe-bf0f6bea0ba9
Intrinsec Egregor Nov 2020ATTACK:enterprise:S0554 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f0a74237-9a46-4ea8-a268-3ac87f593ea9
JoeSecurity Egregor 2020 · NHS Digital Egregor Nov 2020