Ragnar Locker vows to leak data if victim contacts the police
The ransomware gang said victims hiring "professional negotiators" are making the recovery process worse
The Ragnar Locker group, which has hit large companies with ransomware attacks, has warned it will leak victims’ data if they contact the police or FBI.
The hacking group said it would publish full data of victims if they contacted any law enforcement agencies in an announcement on its darknet website.
The ransomware gang said victims hiring "professional negotiators" are making the recovery process worse, as these negotiators often work with law enforcement through data recovery companies, according to Bleeping Computer.
"So from this moment we warn all our clients, if you will hire any recovery company for negotiations or if you will send requests to the police/FBI/investigators, we will consider this as a hostile intent and we will initiate the publication of whole compromised data immediately," a note read on its website.
Ilia Kolochenko, founder of ImmuniWeb, told IT Pro that such would disincentivize many victims from contacting the authorities.
“Nonetheless, in many ransomware cases, law enforcement agencies are of little to no help for the victims being overloaded with pending cases and complex investigations. But hiring external or internal professionals to meticulously investigate the incident is crucial for all victimized companies,” he said.
Chris Sedgwick, director of security operations at cyber security firm Talion, told ITPro the motive behind this announcement is to encourage more victims to pay their ransom demands.
RELATED RESOURCE
Defeating ransomware with unified security from WatchGuard
How SMBs can defend against the onslaught of ransomware attacks
“However, while this is a serious threat that should not be ignored, it is worth considering how Ragnar Locker will know when a company has contacted law enforcement, especially if they are working behind the scenes?! This seems to be more of a scare technique, designed to cause panic,” Sedgwick said.
Martin Jartelius, CSO at Outpost24, told IT Pro this must be seen as a partial success for the pressure applied after some earlier breaches aroused substantial attention from the US government, where the exerted pressure led to a temporary dismantling of one threat actors’ operations.
“Clearly the group is uncomfortable with such attention, which can only be seen as a positive change. This can’t continue to be a relatively risk-free form of digital international sabotage,” Jartelius said.
-
Ransomware cartels are fragmenting into volatile splinter groups, warns Met Police cyber chiefNews Commoditized "cyber crime bazaars" and AI data mining are forcing law enforcement to rewrite its playbook
-
New ransomware threat group, The Gentlemen, has become one of the most active ransomware operators, accounting for 10% of all attacksNews NTT researchers warn that the RaaS group is leveraging SystemBC malware to establish covert tunnelling, evade detection, and support rapid lateral movement across enterprise environments
-
Instructure chose to a pay ransom following the Canvas cyber attack – research shows more than half of security leaders would follow suitAnalysis Opting to pay ransoms creates huge risks for enterprises – you’re relying on the word of criminals
-
Ransomware negotiator sentenced for role in major cyber crime groupNews Deniss Zolotarjovs was a key player in a group associated with Conti
-
Threat actors ditch ‘spray and pray’ attacks in shift to targeted exploitationNews A dip in ransomware volumes points to a more targeted approach focused on vulnerability exploitation
-
Security leaders overconfident about ransomware recovery
News Few manage to recover all their data, and many experience business disruption
-
German authorities want your help finding the hackers behind GandCrab and REvilNews Daniil Maksimovich Shchukin and Anatoly Sergeevitsch Kravchuk are believed to have made millions from ransomware as a service schemes
-
The rise of teen hackers ‘makes for a good headline’, but cyber crime activities peak later in life
News With family responsibilities and mortgages to pay, it's not teenagers dishing out malware or carrying out cyber extortion
