Loading malware…
Ranzy Locker is a ransomware family observed in 2021 and identified as one of the top ransomware variants in Q3 2021, accounting for 3.0% market share in the cited reporting. The provided content links it to Windows recovery inhibition behavior intended to increase extortion pressure on victims. Specifically, Ranzy Locker uses bcdedit to disable automatic Windows recovery features, including settings such as recoveryenabled set to No and bootstatuspolicy set to ignoreallfailures, aligning with MITRE ATT&CK T1490 (Inhibit System Recovery). It is also reported to use wbadmin to delete system state backups. These actions are designed to prevent restoration of encrypted systems and make recovery more difficult. The broader reporting context describes ransomware operations in this period as commonly targeting mid-sized organizations, often using weak RDP configurations, phishing, and software vulnerability exploitation for initial access, but the provided content does not attribute specific initial access methods, victim sectors, threat actors, or unique indicators of compromise directly to Ranzy Locker beyond its recovery-disabling and backup-deletion behavior.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ranzy Locker is a ransomware family that disables Windows recovery features and deletes system state backups to prevent victims from restoring their systems after an attack.
Ranzy Locker is a ransomware variant that encrypts files and demands ransom, targeting a range of organizations.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.