The Kivu Threat Intelligence Team’s proprietary research into Egregor’s blockchain payments was combined with our forensic investigations, yielding an understanding of the structure and behaviors as a group. Egregor models the current trend of ransomware by integrating a level-based system. Through the meticulous coordination and hierarchy witnessed in our study, Egregor’s Ransomware as a Service model can be considered an organized crime and unveils data supporting the emergence of highly structured and interconnected ransomware groups.