Egregor ransomware:
The legacy of Maze lives on

The new gang may be young, but it is already doing serious damage

View whitepaper

At the start of November 2020, one of the most ruthless ransomware gangs, Maze, announced its retirement. At the surface this seems like great news, but the reality is that we haven’t seen the last of Maze. Group-IB has found striking similarities between the group’s modus operandi and that of a new ransomware: Egregor.

In this white paper, you’ll read about:

  • Evidence that Maze is gone in name only
  • Egregor’s TTPs mapped to MITRE ATT&CK®
  • The connection between Qakbot and Egregor

We use cookies on the website to make your browser experience more personal, convenient and secure. You may block or manage the use of cookies, however, in some cases they’re essential to make this site work properly. Learn more about cookies in Group-IB Privacy And Cookies Policy.