{"id":39573,"date":"2021-02-14T15:41:34","date_gmt":"2021-02-14T15:41:34","guid":{"rendered":"http:\/\/1d849d2b-d8bd-41fa-97ae-00210a886334"},"modified":"2021-02-14T15:41:34","modified_gmt":"2021-02-14T15:41:34","slug":"egregor-ransomware-operators-arrested-in-ukraine","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/egregor-ransomware-operators-arrested-in-ukraine\/","title":{"rendered":"Egregor ransomware operators arrested in Ukraine"},"content":{"rendered":"
\"egregor.png\"<\/span>
<\/span><\/figcaption><\/figure>\n

Members of the Egregor ransomware cartel have been arrested this week in Ukraine, French radio station France Inter<\/a> reported on Friday, citing law enforcement sources.<\/p>\n

The arrests, which have not been formally announced, are the result of a joint investigation between French and Ukrainian police.<\/p>\n

Sources in the threat intel community have confirmed the existence of a law enforcement action but declined to comment for the time being.<\/p>\n

The names of the suspects have not been released. France Inter said the arrested suspects provided hacking, logistical, and financial support for the Egregor gang.<\/p>\n

The Egregor gang, which began operating in September 2020, operates based on a Ransomware-as-a-Service (RaaS) model. They rent access to the actual ransomware strain, but they rely on other cybercrime gangs to orchestrate intrusions into corporate networks and deploy the file-encrypting ransomware.<\/p>\n

Victims who resist paying the extortion fee are often listed on a so-called “leak site<\/a>,” in the hopes of shaming them into paying the ransom demand. Victims who don’t pay often have internal documents and files shared on the Egregor leak site as punishment.<\/p>\n

\"Egregor<\/span>