H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Egregor](https://attack.mitre.org/software/S0554) is a Ransomware-as-a-Service (RaaS) tool that was first observed in September 2020. Researchers have noted code similarities between [Egregor](https://attack.mitre.org/software/S0554) and Sekhmet ransomware, as well as [Maze](https://attack.mitre.org/software/S0449) ransomware.(Citation: NHS Digital Egregor Nov 2020)(Citation: Cyble Egregor Oct 2020)(Citation: Security Boulevard Egregor Oct 2020)

Labels

malware

25 recorded

Relationships

uses

Technique

uses

to Data Encrypted for Impact

Technique

uses

to Data from Network Shared Drive

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Disable or Modify Tools

Technique

uses

to DLL

Technique

uses

to Domain Groups

Technique

uses

to Group Policy Modification

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Masquerade Task or Service

Technique

uses

Technique

uses

Technique

uses

to Process Injection

Technique

uses

Technique

uses

to Remote Access Tools

Technique

uses

Technique

uses

to Software Packing

Technique

uses

to System Information Discovery

Technique

uses

to System Network Connections Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to System Time Discovery

Technique

uses

to Time Based Checks

Technique

uses

to Virtualization/Sandbox Evasion

Technique

uses

to Web Protocols

Technique

uses

to Windows Command Shell

Technique

5 external

References

mitre-attack

S0554

Egregor

—

NHS Digital Egregor Nov 2020

https://digital.nhs.uk/cyber-alerts/2020/cc-3681#summary

Cyble Egregor Oct 2020

https://cybleinc.com/2020/10/31/egregor-ransomware-a-deep-dive-into-its-activities-and-techniques/

Security Boulevard Egregor Oct 2020

https://securityboulevard.com/2020/10/egregor-sekhmets-cousin/