{ "id": "baf47661-75a5-448c-a467-ff55ae96b0a4", "created_at": "2026-04-06T00:15:22.528154Z", "updated_at": "2026-04-10T13:12:09.958145Z", "deleted_at": null, "sha1_hash": "0addaf89984e731f8c04cb9375cecd46625156ac", "title": "QBot partners with Egregor ransomware in bot-fueled attacks", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 2696781, "plain_text": "QBot partners with Egregor ransomware in bot-fueled attacks\r\nBy Lawrence Abrams\r\nPublished: 2020-11-20 · Archived: 2026-04-05 17:12:59 UTC\r\nThe Qbot banking trojan has dropped the ProLock ransomware in favor of the Egregor ransomware who burst into activity\r\nin September.\r\nQbot, otherwise known as QakBot or QuakBot, is Windows malware that steals bank credentials, Windows domain\r\ncredentials, and provides remote access to threat actors who install ransomware.\r\nVictims usually become infected with Qbot through phishing emails utilizing Excel documents that pretend to be DocSign\r\ndocuments, as shown below.\r\nhttps://www.bleepingcomputer.com/news/security/qbot-partners-with-egregor-ransomware-in-bot-fueled-attacks/\r\nPage 1 of 5\n\n0:00\r\nhttps://www.bleepingcomputer.com/news/security/qbot-partners-with-egregor-ransomware-in-bot-fueled-attacks/\r\nPage 2 of 5\n\nVisit Advertiser websiteGO TO PAGE\r\nQbot Docusign phishing email\r\nSimilar to how Ryuk works with TrickBot and DoppelPaymer/BitPaymer work with Dridex for access to networks, the\r\nProLock ransomware has historically worked with Qbot to gain access to compromised networks.\r\nWhen the ransomware gang is given access to a network, they use the Cobalt Strike pentesting tool to remotely spread\r\nlaterally through the network while stealing unencrypted files and gathering admin credentials.\r\nOnce the attackers gain access to a domain admin account, they use it to deploy the ransomware throughout the Windows\r\ndomain.\r\nQbot dumps ProLock for Egregor ransomware\r\nIn a new report by Oleg Skulkin, Senior Digital Forensics Analyst at Group-IB. a Singapore-based cybersecurity company,\r\nhas found that Qbot is has stopped distributing ProLock and is now working with Egregor.\r\nSince their launch in September 2020, Egregor has been one of the most active big game hunting ransomware operations\r\ncurrently active.\r\nAfter the notorious Maze ransomware gang began shutting down their operation in September, many of their affiliates\r\nmoved to the new Egregor operation.\r\nFueled by experienced ex-Maze affiliates and hackers, Egregor quickly started amassing a huge amount of victims\r\nworldwide.\r\n\"In less than 3 months Egregor operators have managed to successfully hit 69 companies around the world with 32 targets in\r\nthe US, 7 victims in France and Italy each, 6 in Germany, and 4 in the UK. Other victims happened to be from the APAC,\r\nMiddle East, and Latin America. Egregor’s favorite sectors are Manufacturing (28.9% of victims) and Retail\r\n(14.5%),\" Skulkin explained.\r\nhttps://www.bleepingcomputer.com/news/security/qbot-partners-with-egregor-ransomware-in-bot-fueled-attacks/\r\nPage 3 of 5\n\nEgregor activity since September 2020\r\nSource: Group-IB\r\nWhile the ransomware has changed, Skulkin states that the tactics, techniques, and procedures (TTPs) currently used by\r\nEgregor are similar to the previous attacks with ProLock.\r\n'Tactics, techniques and procedures observed are very similar to those seen in the past Qakbot’s Big Game Hunting\r\noperations,” Skulkin stated  in a report shared with BleepingComputer.\r\nAs more Maze affiliates become involved in the Egregor operation, Skulkin expects the TTPs to eventually align to those\r\nseen historically in Maze attacks.\r\nAs the ransomware landscape continually evolves, threat actors switch to different operations, and partnerships are made, it\r\nis important for security professionals to keep track of the TTPs used by each operation to defend against them.\r\n\"The use of CobaltStike and QakBot are to watch when hunting for Egregor. More threat hunting and detection tips from\r\nGroup-IB DFIR team as well as a detailed technical analysis of Egregor operations are available in Group-IB’s blog,\"\r\nSkulkin offers as advice when defending against Egregor.\r\nSince its launch, Egregor has been responsible for other high profile attacks on Crytek, Ubisoft, Cencosud, and Barnes and\r\nNoble.\r\nhttps://www.bleepingcomputer.com/news/security/qbot-partners-with-egregor-ransomware-in-bot-fueled-attacks/\r\nPage 4 of 5\n\nAutomated Pentesting Covers Only 1 of 6 Surfaces.\r\nAutomated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the\r\nother.\r\nThis whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic\r\nquestions for any tool evaluation.\r\nSource: https://www.bleepingcomputer.com/news/security/qbot-partners-with-egregor-ransomware-in-bot-fueled-attacks/\r\nhttps://www.bleepingcomputer.com/news/security/qbot-partners-with-egregor-ransomware-in-bot-fueled-attacks/\r\nPage 5 of 5", "extraction_quality": 1, "language": "EN", "sources": [ "ETDA" ], "origins": [ "web" ], "references": [ "https://www.bleepingcomputer.com/news/security/qbot-partners-with-egregor-ransomware-in-bot-fueled-attacks/" ], "report_names": [ "qbot-partners-with-egregor-ransomware-in-bot-fueled-attacks" ], "threat_actors": [ { "id": "610a7295-3139-4f34-8cec-b3da40add480", "created_at": "2023-01-06T13:46:38.608142Z", "updated_at": "2026-04-10T02:00:03.03764Z", "deleted_at": null, "main_name": "Cobalt", "aliases": [ "Cobalt Group", "Cobalt Gang", "GOLD KINGSWOOD", "COBALT SPIDER", "G0080", "Mule Libra" ], "source_name": "MISPGALAXY:Cobalt", "tools": [], "source_id": "MISPGALAXY", "reports": null } ], "ts_created_at": 1775434522, "ts_updated_at": 1775826729, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/0addaf89984e731f8c04cb9375cecd46625156ac.pdf", "text": "https://archive.orkl.eu/0addaf89984e731f8c04cb9375cecd46625156ac.txt", "img": "https://archive.orkl.eu/0addaf89984e731f8c04cb9375cecd46625156ac.jpg" } }