{"id":45628,"date":"2022-03-09T02:05:41","date_gmt":"2022-03-09T02:05:41","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/fbi-says-ragnar-ransomware-gang-hit-52-critical-us-orgs\/"},"modified":"2022-03-09T02:05:41","modified_gmt":"2022-03-09T02:05:41","slug":"fbi-says-ragnar-ransomware-gang-hit-52-critical-us-orgs","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/fbi-says-ragnar-ransomware-gang-hit-52-critical-us-orgs\/","title":{"rendered":"FBI says Ragnar ransomware gang hit 52 critical US orgs"},"content":{"rendered":"

The Ragnar Locker ransomware gang has so far infected or compromised at least 52 critical infrastructure organizations in America across sectors including manufacturing, energy, financial services, government, and information technology, according to an FBI alert this week.<\/p>\n

The Feds said<\/a> [PDF] they became aware of the ransomware crew in early 2020 and the miscreants’ preferred tactic: double extortion. The crooks steal sensitive data, encrypt a victim’s systems, and threatens to leak the stolen documents if the ransom to restore the files isn’t paid.<\/p>\n

To date, the Ragnar Locker criminals have posted stolen data<\/a> from at least ten organizations on their publicity website, according to Acronis. In its latest cyber-crime spree, the gang hit entities across nearly a dozen critical sectors as of January, according to the FBI flash alert, which also provides technical details about how the ransomware attacks work: <\/p>\n

The Ragnar Locker malware uses Windows API GetLocaleInfoW to identify the infected machine’s location. If the victim’s locale is one of a dozen European and Asian countries, including Russia, Ukraine, and other states, the infection process terminates.<\/p>\n

As the ransomware is deployed, it kills services commonly used by managed service providers to remotely control networks and attempts to silently delete all shadow copies of documents so that users can’t recover encrypted files.<\/p>\n