Ranzy Locker Ransomware was behind compromising 30 U.S. firms this year, FBI warned

Ranzy Locker ransomware first emerged in 2020, targeting sectors like construction, facilities, information technology, and transportation. The compromised data includes customer information, PII-related files, and financial records from infected systems, which were reportedly exfiltrated following the deployment of the ransomware.

FBI has **published** a flash alert stating that threat actors employing Ranzy Locker Ransomware have already compromised 30 U.S businesses this year.

_Ranzy Locker ransomware submissions (ID Ransomware)_ <br>

Most of the operations were executed by a brute force attack that targets remote Desktop Protocol (RDP) credentials to access networks. Actors have recently switched up their techniques to exploit the Microsoft Exchange Server vulnerabilities and phishing to infiltrate networks.

_Ranzy Locker Tor payment site_ <br>

Files are encrypted using Ranzy Locker, and the system is left with a ransom note in all directories, which has details regarding the payment for the decryption tool. The Ranzy Locker executable further attempts to penetrate other attached networks.

The ransom notes from sample victims presented a lot of similarities with both their previous variants AKO and ThunderX

Technical Analysis

The Ranzy Locker Executable named `subID` is a 32-bit PE (portable executable) that requires administrator credentials to run. The samples found in victim computers have the same functionality but differ in the hash value. The executable file contains hex coded strings that can delete backups from a system and disable Windows Error Recovery.

Points for detection in a sample Ranzy YARA Rule:

Few recommended mitigations from the flash alert include up-to-date antivirus software on all hosts and implementing regular backups for data. Double authentication is advised on all accounts or services as an additional layer of protection.

Ranzy Locker Ransomware was behind compromising 30 U.S. firms this year, FBI warned

Related threat feeds

Daxin Malware Resurfaces in Taiwan Alongside Novel Stupig Backdoor After Decade Long Silence

Technical Analysis

Points for detection in a sample Ranzy YARA Rule:

148 Malicious npm Packages Used to Build a Browser Based DDoS Botnet

Pakistan Law Enforcement Agencies Targeted in Alleged Multi Group Cyber Espionage Operations