Cybereason has issued a global Threat Analysis Report investigating the Ragnar Locker ransomware gang and its attacks on networks of global critical infrastructure operators. Ragnar Locker first emerged in 2019, and since its debut hundreds of companies have been victimized. Cybereason assesses the threat level of Ragnar Locker ransomware attacks against critical infrastructure operators as HIGH.
After Ragnar Locker carried out more than 50 successful attacks against U.S. critical infrastructure operators, the FBI issued a Flash Advisory earlier this year warning the operators to increase their diligence against possible attacks. Recently, Ragnar Locker claimed responsibility for an attack on DESFA, Greece’s largest natural gas provider.
Ragnar Locker has been using the double extortion scheme on their victims. Double extortion works when attackers penetrate a victim’s network, steal sensitive information by moving laterally through the organization and threaten to publish the stolen data unless the ransom demand is paid.
Other key findings of the investigation include:
- Security Evasion Capabilities: Ragnar Locker checks if specific products are installed, especially security products (antivirus), virtual-based software, backup solutions and IT remote management solutions.
- Active for Three Years: Ragnar Locker is both a ransomware group and the name of the software in use. They have been running since 2019 and targeting critical industries. They use the double extortion scheme.
- Excluding the Commonwealth of Independent States: Ragnar Locker avoids being executed from countries since the group is located in the Commonwealth of Independent States (CIS).