IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Ragnar Locker vows to leak data if victim contacts the police

The ransomware gang said victims hiring "professional negotiators" are making the recovery process worse

The Ragnar Locker group, which has hit large companies with ransomware attacks, has warned it will leak victims’ data if they contact the police or FBI. 

The hacking group said it would publish full data of victims if they contacted any law enforcement agencies in an announcement on its darknet website.

The ransomware gang said victims hiring "professional negotiators" are making the recovery process worse, as these negotiators often work with law enforcement through data recovery companies, according to Bleeping Computer.

"So from this moment we warn all our clients, if you will hire any recovery company for negotiations or if you will send requests to the police/FBI/investigators, we will consider this as a hostile intent and we will initiate the publication of whole compromised data immediately," a note read on its website.

Ilia Kolochenko, founder of ImmuniWeb, told IT Pro that such would disincentivize many victims from contacting the authorities.

“Nonetheless, in many ransomware cases, law enforcement agencies are of little to no help for the victims being overloaded with pending cases and complex investigations. But hiring external or internal professionals to meticulously investigate the incident is crucial for all victimized companies,” he said.

Chris Sedgwick, director of security operations at cyber security firm Talion, told ITPro the motive behind this announcement is to encourage more victims to pay their ransom demands. 

Related Resource

Defeating ransomware with unified security from WatchGuard

How SMBs can defend against the onslaught of ransomware attacks

Whitepaper title above a red triangle with an exclamation point insideFree download

“However, while this is a serious threat that should not be ignored, it is worth considering how Ragnar Locker will know when a company has contacted law enforcement, especially if they are working behind the scenes?! This seems to be more of a scare technique, designed to cause panic,” Sedgwick said.

Martin Jartelius, CSO at Outpost24, told IT Pro this must be seen as a partial success for the pressure applied after some earlier breaches aroused substantial attention from the US government, where the exerted pressure led to a temporary dismantling of one threat actors’ operations. 

“Clearly the group is uncomfortable with such attention, which can only be seen as a positive change. This can’t continue to be a relatively risk-free form of digital international sabotage,” Jartelius said.

Featured Resources

The state of Salesforce: Future of business

Three articles that look forward into the changing state of Salesforce and the future of business

Free Download

The mighty struggle to migrate SAP to the cloud may be over

A simplified and unified approach to delivering Enterprise Transformation in the cloud

Free Download

The business value of the transformative mainframe

Modernising on the mainframe

Free Download

The Total Economic Impact™ Of IBM FlashSystem

Cost savings and business benefits enabled by FlashSystem

Free Download

Recommended

Ransomware now strikes one in 40 organisations per week, Check Point finds
ransomware

Ransomware now strikes one in 40 organisations per week, Check Point finds

27 Jul 2022
What is zero trust?
network security

What is zero trust?

14 Jul 2022
Retbleed hardware-level flaw brings overhead woe to Intel and AMD
Hardware

Retbleed hardware-level flaw brings overhead woe to Intel and AMD

13 Jul 2022
An analysis of the European cyber threat landscape
Whitepaper

An analysis of the European cyber threat landscape

8 Jul 2022

Most Popular

How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

29 Jul 2022
Samsung proposes 11 Texas semiconductor plants worth $191 billion
Hardware

Samsung proposes 11 Texas semiconductor plants worth $191 billion

21 Jul 2022
Should you take your password manager off the internet?
Sponsored

Should you take your password manager off the internet?

28 Jul 2022