Severity
Medium
Analysis Summary
A Ragnar Locker ransomware campaign is seen after months, since it hit the energy giant EDP for $10.9M back in April. Once it successfully encrypts the files of a target system, the threat actor operating the RagnarLocker ransomware threatens the compromised company with data leakage if a ransom amount is not paid. The group threatens: “we will publish this Leak in Huge and famous journals and blogs, also we will notify all your clients, partners and competitors. So it’s depend on you make it confidential or public !” According to the ransom note dropped on the EDP encrypted systems, the attackers were able to steal confidential information on billing, contracts, transactions, clients, and partners. Below is their sample ransom note:
The Ragnar Locker operators target software regularly used by managed service providers to prevent their attack from being detected and blocked. After reconnaissance and pre-deployment stages, the attackers drop a highly targeted ransomware executable that adds specific extension to encrypted files, features an embedded RSA-2048 key, and drops custom ransom notes. The ransom notes include the victim’s company name, a link to the Tor site, and the data leak site with the victim’s published data. Like the last time, the targets of this attack appear to be Portuguese.
Impact
- System Takeover
- Files Encryption
- Confidentiality breach
- Data exposure
Indicators of Compromise
MD5
- cf0a78562c103831dfe6eca6bec99cb9
- e03bb74167a5349f96ff88e5f0ed94f3
- 61a9b3b5320cb4d06155542a25868194
- 73cb5a82f9a2913efd3139f25d86d40e
SHA-256
- 6264e1b62b9fe6662a9fc2a131f316547c9ed0c3684e51423a3e25f09c238d55
- 390eda84632720eb71c5f1d1c0b05ac280a4f67364745a9491476a6d0d9c113b
- 828f247bfa33757043c29ef4379109368f5e6263248436fbf9b9240fd3fe2ebf
- a30bea3ba2c697013bbda0140e5d42dc1d51304055d81eee26d2be7a2d05483d
SHA1
- 588c10739ef20be93cb8f0b2de90d23027fbf281
- 7a99c3d4e361c97dc2c27e077c4c55e5c47cbe36
- 83f117bb1cceff7837933a070c5b917f42539b11
- 247666c54e346782b4c7822135441154e092a76a
Source IP
- 94[.]237[.]109[.]49
Remediation
- Block the threat indicators at their respective controls.
- Only buy licensed and well reputed products.
- Keep all software updated to latest versions.
- Maintain offline backups for files.
- Minimize internet exposure of critical assets storing confidential data.