Introduction
Ragnar Locker is a ransomware identified in December 2019 that targetscorporate networks inBig Game Huntingtargeted attacks. This reportpresents recent elements regarding this ransomware.
Activities and Tactics
Information pending cataloguing.
Notable Campaigns
Information pending cataloguing.
Tactics, Techniques, and Procedures (TTPs)
Ransomware Vulnerability Matrix observations
| Category | Vendor | Product | CVEs |
|---|---|---|---|
| Microsoft Products | Windows | COM | CVE-2017-0213 |
| Microsoft Products | Windows | Microsoft Office | CVE-2018-0802 |
Notable Indicators of Compromise (IOCs)
No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.
Malware and Tools
- Ragnatela:
Ransomware Tool Matrix observations
| Category | Observed tools |
|---|---|
| Defense Evasion | VirtualBox |
| Discovery | Advanced Port Scanner, Dsquery, PsInfo, SoftPerfect LanSearchPro |
| LOLBAS | PsExec, WMIC |
| OffSec | Cobalt Strike |
| RMM Tools | AnyDesk, Remote Manipulator System (RMS), RemoteUtilities |
Attribution and Evidence
Information pending cataloguing.
References
References pending cataloguing.