A Ragnar Locker ransomware campaign is seen after months, since it hit the energy giant EDP for $10.9M back in April. Once it successfully encrypts the files of a target system, the threat actor operating the RagnarLocker ransomware threatens the compromised company with data leakage if a ransom amount is not paid. The group threatens: “we will publish this Leak in Huge and famous journals and blogs, also we will notify all your clients, partners and competitors. So it’s depend on you make it confidential or public !” According to the ransom note dropped on the EDP encrypted systems, the attackers were able to steal confidential information on billing, contracts, transactions, clients, and partners. Below is their sample ransom note:
The Ragnar Locker operators target software regularly used by managed service providers to prevent their attack from being detected and blocked. After reconnaissance and pre-deployment stages, the attackers drop a highly targeted ransomware executable that adds specific extension to encrypted files, features an embedded RSA-2048 key, and drops custom ransom notes. The ransom notes include the victim’s company name, a link to the Tor site, and the data leak site with the victim’s published data. Like the last time, the targets of this attack appear to be Portuguese.