Ragnar Locker Ransomware
First seen in late 2019, RagnarLocker an advanced human-operated ransomware and infostealer targeting high-value organisations across Europe, North America and East Asia. Notably, its operators are highly aggressive in leaking affected organisations data.
Summary
First seen in late 2019, RagnarLocker an advanced human-operated ransomware and infostealer targeting high-value organisations across Europe, North America and East Asia. Notably, its operators are highly aggressive in leaking affected organisations data.
Affected platforms
The following platforms are known to be affected:
Threat details
Introduction
Ragnar Locker is a sophisticated C++ based ransomware and information stealing tool developed by an unidentified Russian-speaking threat actor. First observed in December 2019, it has targeted large or high-value energy, telecommunications, entertainment, and government organisations in Western Europe and North America.
Delivery
Like most human-operated ransomware, Ragnar Locker is delivered as the final payload in much longer attack chains following a period of target profiling, network reconnaissance, and data extraction. Ragnar Locker's operators typically gain access to target networks using a combination of RDP brute-force and credential reuse attacks. If successful, they will attempt to gain administration-level access before using Group Policy Objects (GPO) and PowerShell script to propagate across the network. Information gathered during this phase is used to construct Ragnar Locker's operating parameters.
The group then use a GPO task to invoke msiexec.exe to download and install an MSI package. This package contains a working version of Oracle's VirtualBox hypervisor along with a Windows XP virtual disk image, itself containing a Ragnar Locker executable. When installed, the VirtualBox instance is executed and runs the Windows disk image. A secondary GPO task run at this time enumerates all local, network, and removable drives.
Activities
Once successfully deployed in the hypervisor, Ragnar Locker will attempt to close a large number of security, database, and managed service tools; before deleting and disabling any Volume Shadow Copies.
Using the information provided by the secondary script, Ragnar Locker then configures all enumerated drive before encrypting them using an AES implementation, the keys for which are then encrypted using RSA-2048.
Remediation advice
If a device on your network becomes infected with ransomware it will begin encrypting files, which may also include remote files on network locations. The only guaranteed way to recover from a ransomware infection is to restore all affected files from their most recent backup. To limit the impact of a ransomware infection, NHS Digital advises that:
- Critical data is frequently saved in multiple backup locations.
- At least one backup is kept offline at any time (separated from live systems).
- Backups and incident recovery plans are tested to ensure that data can be restored when needed.
- User account permissions for modifying data are regularly reviewed and restricted to the minimum necessary.
- Infected systems are disconnected from the network and powered down as soon as practicable.
- Any user account credentials that may have been compromised should be reset on a clean device
- Where infected systems cannot be quarantined with confidence, then an affected organisation should disconnect from national networks to limit propagation.
Additionally, to prevent and detect an infection, NHS Digital advises that:
- Secure configurations are applied to all devices.
- Security updates are applied at the earliest opportunity.
- Tamper protection settings in security products are enabled where available.
- Obsolete platforms are segregated from the rest of the network.
- IT usage policies are reinforced by regular training to ensure all users know not to open unsolicited links or attachments.
- Multi-factor authentication (MFA) and lockout policies are used where practicable, especially for administrative accounts.
- Administrative accounts are only used for necessary purposes.
- Remote administration services use strongly encrypted protocols and only accept connections from authorised users or locations.
- Systems are continuously monitored, and unusual activity is investigated, so that a compromise of the network can be detected as early as possible.
Please note that NCSC maintains guidance for securely configuring a wide range of end user device (EUD) platforms. For further details refer to their end user device security guidance pages.
Definitive source of threat updates
Last edited: 25 November 2020 3:01 pm