Egregor's primary goal is financial extortion. Their tactics are centered around maximizing pressure on victims to force a ransom payment. This is achieved through a double-extortion model where they first steal sensitive corporate data and then encrypt the network. If the victim hesitates to pay, the group publishes the stolen data on a public leak site, adding a layer of public humiliation and regulatory risk to the incident.

These actors are jacks-of-all-trades when it comes to getting inside a network. They often gain initial access through compromised credentials for Remote Desktop Protocol (RDP) or VPNs. Phishing emails with malicious attachments are another common entry point. Once inside, they use popular penetration testing tools like Cobalt Strike and network scanners to map the environment, escalate privileges, and move laterally to compromise as much of the network as possible.

Egregor's procedures show a clear, methodical approach. After initial access, they deploy malware like QakBot or IcedID to establish a foothold. They then use tools like Rclone (often disguised as svchost) and 7zip to exfiltrate large volumes of data. Once the data is secured, they execute the ransomware payload, which encrypts files and even uses the victim's own printers to print out copies of the ransom note, titled "RECOVER-FILES.txt," ensuring the message is received loud and clear.