Egregor’s Rampage Continues

Since Egregor’s discovery in late September early October of 2020, the ransomware has wrecked a bloody toll in the short time it has been actively claiming victims. The first few of which included Barnes and Noble, Crytek, and Ubisoft. Since the apparent retirement of the Maze ransomware gang, Egregor has been quick to capitalize on the gap left in the market by Maze’s departure. Not only has the group behind Egregor been quick to fill the gap left by the Maze gang, but they have also been quick to adopt the tactics that made Maze so successful. Namely the human-operated tactics involving targeting large organizations with complex networks increases the likelihood of demanding a bigger ransom once critical network assets are encrypted resulting in increased downtime. Secondly, Egregor was quick to adopt the double-extortion tactic which involves the stealing and subsequent releasing of sensitive data from vic...

RestorFile Ransomware

RestorFile is the name of a malicious program, belonging to the Matrix ransomware family. Systems infected with this malware experience data encryption and receive ransom demands for the decryption. During the encryption process, affected files are retitled with a random character string and the ".[RestorFile@tutanota.com]" extension (which contains the cyber criminals' email address). For example, a file originally named "1.jpg" would appear as something similar to "Dm1VcZ9U-DOAwLcvy.[RestorFile@tutanota.com]" - following encryption. Once this process is complete, ransom notes - "#Decrypt_Files_ReadMe#.rtf" are dropped into compromised folders. The ransom-demanding message in "#Decrypt_Files_ReadMe#.rtf" informs victims that their data has been encrypted using the RSA-2048 and AES-128 cryptographic algorithms. According to the note, the only way of restoring the files is by purchasing the decryption keys ...