Loading malware…
Ranzy Locker is a Windows ransomware family that emerged in late 2020 as a rebranded successor to ThunderX and has also been linked by lineage and shared infrastructure to Ako. It was used by financially motivated operators in intrusions against U.S. organizations across sectors including construction, academia, information technology, transportation, manufacturing, and government-related environments. By mid-2021 it had been associated with compromises of more than 30 U.S. businesses.
Ranzy Locker is operated as a double-extortion ransomware, combining file encryption with theft of sensitive data and threats to publish stolen information if victims refuse to pay. Reported pre-encryption collection objectives included customer information, personally identifiable information, and financial records. The malware encrypts files on compromised Windows systems, including servers, virtual machines, and attached network shares, and leaves ransom notes throughout affected directories. Operators also maintained a leak site and negotiation portal to pressure victims and facilitate payment discussions.
Observed initial access methods included brute-force attacks against Remote Desktop Protocol credentials, use of valid accounts over RDP, exploitation of known Microsoft Exchange Server vulnerabilities, and phishing. Post-compromise behavior included attempts at lateral movement across the victim network, discovery of mounted drives and SMB shares, enumeration of processes, and network-oriented discovery activity. Ranzy Locker also attempted to establish additional accounts in some environments.
The malware includes anti-recovery and defense-evasion behavior typical of mature ransomware operations. It deletes shadow copies and backups, disables Windows recovery features, and can terminate processes or services that keep files open in order to maximize encryption coverage. Technical reporting has also described use of Windows APIs for system interaction and anti-debugging checks. Public reporting further characterizes Ranzy Locker as an improved continuation of ThunderX after flaws in earlier ThunderX samples enabled free decryption for some victims.
24 distinct techniques documented for this family, organized by ATT&CK tactic.
The ransomware gang leverages valid accounts with Remote Desktop Protocol (RDP) to access target systems.
...эксплойтов, вредоносной рекламы, веб-инжектов...
Recent victims reported the actors leveraged known Microsoft Exchange Server vulnerabilities and phishing as the means of compromising their networks.
Recent victims reported the actors leveraged known Microsoft Exchange Server vulnerabilities and phishing as the means of compromising their networks.
The Ranzy Locker ransomware leverages Windows API for a variety of operations, such as enumerating shared resources, as explained below.
...с помощью email-спама и вредоносных вложений, обманных загрузок... фальшивых обновлений, перепакованных и заражённых инсталляторов
The ransomware gang leverages valid accounts with Remote Desktop Protocol (RDP) to access target systems.
The Ranzy Locker actors may establish new accounts on domain controllers, servers, workstations, or the active directories. Newly created accounts with the name “felix” have been observed on at least three victims of the ransomware.
The ransomware gang leverages valid accounts with Remote Desktop Protocol (RDP) to access target systems.
The Ranzy Locker ransomware uses Base64 encoding to obfuscate its configuration in the ransom note.
The ransomware gang leverages valid accounts with Remote Desktop Protocol (RDP) to access target systems.
The Ranzy locker ransomware group uses IsDebuggerPresent API call to detect debuggers by checking if a program is running in debugging mode.
A majority of victims reported the actors conducted a brute force attack targeting Remote Desktop Protocol (RDP) credentials to gain access to the victims’ networks.
Ranzy reads the host file ( C:\Windows\System32\drivers\etc\hosts ) to discover the hostname to IP address mappings of remote systems.
Ranzy uses Windows Native API calls to enumerate running processes.
The ransomware queries the volume information to determine the disks in the system.
The Ranzy Locker ransomware discovers critical files to exfiltrate, such as customer data, personally identifiable information (PII) files, and financial records. It uses GetLogicalDrives API call to enumerate all mounted drives.
The Ranzy Locker ransomware scans all drive letters to infect USB drives.
Ranzi utilizes NetShareEnum API call for discovering shared resources, such as SMB network shares, to encrypt files stored in these resources. It also sends ARP broadcast requests for network device lookup.
The Ranzy locker ransomware group uses IsDebuggerPresent API call to detect debuggers by checking if a program is running in debugging mode.
Может распространяться путём взлома через незащищенную конфигурацию RDP
The actors attempted to locate important files to exfiltrate, such as customer information, PII related files, and financial records.
In an example of double extortion techniques, Ranzy actors in some cases have demanded a second ransom from the victim in exchange for not leaking the data on the Internet.
Группа, управляющая Ranzy Locker, запустила сайт "Ranzy Leak" для публикации украденных данных.
Some of these strings are commands used to delete any backups on the system.
Этот крипто-вымогатель шифрует данные пользователей с помощью Salsa20... К зашифрованным файлам добавляется случайное расширение... В обновленном варианте стало использоваться расширение: .tx_locked... Позже, вариант Ranzy Locker получил расширения .RNZ и .ranzy
When encrypting files, the ransomware will use a Windows API called the 'Windows Restart Manager' that will terminate processes or Windows services that keep a file open and prevent it from being encrypted.
wmic.exe SHADOWCOPY /nointeractive ... wbadmin DELETE SYSTEMSTATEBACKUP ... bcdedit.exe /set {default} recoveryenabled No ... vssadmin.exe Delete Shadows /All /Quiet
19 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.