Ragnar Locker Gang Threatens Victims to Stay Quiet

In the news this week are multiple stories of the Ragnar Locker gang using scare tactics to keep victims silent and prevent them from alerting local law enforcement or the FBI.

What is Going On?

Both Data Breach Today and Threatpost are talking about the Ragnar Locker ransomware gang, who have taken things up a notch when dealing with victims. Operating like old TV criminals, these threat actors are threatening to release victims' data online if they alert the police, hire special forensic investigators, or involve a ransom negotiator or the feds. Instead, they are being told to shut up and pay up.

According to a notice posted on Ragnar Locker's leak site,
"If you will hire any recovery company for negotiations or if you will send requests to the police/FBI/investigators, we will consider this as a hostile intent, and we will initiate the publication of whole compromised data immediately."

The gang continued their threat in broken English with,

"Don't think please that any negotiators will be able to deceive us, we have enough experience and many ways to recognize such a lie."

"In our practice, we has facing with the professional negotiators much more often in last days. Unfortunately, it's not making the process easier or safer, on the contrary, it's actually makes all even worse."

The FBI Warns Companies About Ragnar Locker

In 2020, the FBI posted a dire warning about the Ragnar Locker gang and their slow, persistent operation. First, the group targets an organization; then they spend some time fishing around for private files, backups, archives, and anything of value to steal. Finally, they use various encryption techniques to execute the attack.

Threatpost explains,

"The Ragnar Locker ransomware family frequently switches up obfuscation techniques to slip past detection and prevention. The ransomware attack is identified by the extension ".RGNR <ID>," where <ID> is a hash of the computer's NETBIOS name. The threat actors identify themselves as "RAGNAR_LOCKER" and leave a .txt ransom note, with instructions on how to pay."

The FBI also commented that,

"Ragnar Locker has used VMProtect, UPX, and custom packing algorithms. The ransomware has also been deployed within an attacker's custom Windows XP virtual machine on a target's site."

Ragnar Locker primarily targets private corporations and those in the construction, travel, cloud-service, and enterprise software industries.

Should Companies Pay?

The scare tactics that Ragnar Locker is using are no different than those employed in phishing campaigns where the attackers hope to catch the victims off guard and make them quickly take action without thinking. There is poetic psychopathy about the entire affair. However, the federal government always recommends that companies not pay the ransom. There is even some talk of enacting laws that sanction organizations for paying hackers any ransom.

One of the biggest reasons not to pay is that the promised "key" often does not unlock the files, and the data will remain encrypted, and the company will have lost the ransom and all their files. Another reason is that paying the ransom only proliferates more of the same behavior. If hacker groups failed to collect any ransom, they would eventually give up.

Ultimately the question to pay or not to pay rests with the victim and whether they contact the police and investigators. If they have the means to restore systems on their own, it makes no sense to pay. If, however, they have no clean backups and the only way to restore operations is to retrieve their data with a decryption key, then it may be the only solid course of action a company can take.