While Egregor continues with recent attacks on Kmart, Metro Vancouver's transit system TransLink, and the Randstad staffing agency, Insikt Group researchers at Recorded Future publish a comprehensive report on its activity. Egregor was first noted in a WaterISAC Advisory to members in October for being responsible for a ransomware attack at a large metropolitan water utility. The Insikt research mirrors much of the information highlighted in the aforementioned advisory. Members are highly encouraged to read the entirety of the report at Recorded Future for greater awareness and understanding of observed behavior to help protect against this active and aggressive threat.