Loading story…
Ranzy Locker emerged as a ransomware-as-a-service operation and a rebranded successor to ThunderX, with some code and infrastructure overlap also linked to Ako. Researchers reported that the group adopted double extortion, stealing data before encrypting systems and threatening to publish it on the "Ranzy Leak" site if victims refused to pay. The malware used Salsa20 file encryption with RSA-2048-protected keys, appended extensions such as .ranzy and .RNZ, and directed victims to ransom notes and a Tor-based payment and support portal.
Reporting tied Ranzy intrusions to phishing, exploitation of Microsoft Exchange, and abuse of RDP valid accounts and brute-force access. Once inside a network, the malware enumerated local and network drives, discovered shares, accessed credentials, deleted backups and shadow copies, and disabled recovery options to increase pressure on victims. An FBI flash report cited in one analysis said the gang had compromised more than 30 U.S. businesses across multiple sectors by July 2021, and researchers noted that no public decryptor was available at the time despite detailed mapping of the group's tactics to the MITRE ATT&CK framework.
TTPs, infrastructure, and targeting history in one profile.
8 events from the most recent confirmed update back to the earliest known activity.
On 2021-10-25, the FBI, coordinated with DHS/CISA, issued a FLASH detailing Ranzy Locker indicators of compromise, intrusion methods, victim targeting, and detection artifacts including recurring "felix" accounts and a YARA rule. The notice also said the FBI had first identified Ranzy targeting U.S. victims in late 2020 and reiterated that more than 30 U.S. businesses had been compromised as of July 2021.
An FBI flash report cited in the reporting stated that Ranzy Locker had compromised more than 30 businesses in the United States as of July 2021. Victims were reported in sectors including manufacturing, government, transportation, and IT.
By October 2020, the rebranded Ranzy Locker operation had launched a Tor-based leak site called Ranzy Leak to publish stolen data from non-paying victims. The site had already listed one victim, marking Ranzy's active use of double-extortion pressure infrastructure.
Ranzy emerged in September/October as a ransomware-as-a-service operation and was described as an improved rebrand of ThunderX, with some continuity to Ako. The new variant added stronger encryption and adopted double-extortion tactics including data theft and leak-site pressure.
A free decryption tool for ThunderX was posted to the NoMoreRansom project in September of the referenced year. Reporting says this helped trigger the operators' rebrand to Ranzy.
ThunderX ransomware emerged around August 2020. Subsequent analyses identified Ranzy as a rebranded evolution of ThunderX.
Ranzy Locker was reported as being responsible for dozens of high-profile breaches since late 2020. The activity marked the start of a broader victimization campaign across multiple sectors.
Early Ako ransomware samples were observed around January 2020. Later Ranzy reporting described Ranzy as reusing infrastructure associated with Ako and as a partial successor to it.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 24 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
6 references tracked. Mallory keeps watching after this page renders.
picussecurity.com
Open sourcelabs.sentinelone.com
Open sourcebleepingcomputer.com
Open sourceid-ransomware.blogspot.com
Open sourcecrowdstrike.com
Open sourceic3.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Maze and Ragnar Locker were reported using increasingly sophisticated **double-extortion** tactics that combined data theft, public leak threats, and defense evasion during ransomware intrusions. Maze operators were linked to incidents including the attack on **Cognizant** and the publication of **2GB** of allegedly stolen files from the **City of Pensacola**, underscoring that victims faced both operational disruption and potential data-breach exposure. Reporting also tied Maze to intrusion activity using exposed **RDP**, signed **Cobalt Strike** payloads, **ngrok** tunneling, remote execution with `mshta`, and tailored persistence mechanisms, with one investigated intrusion stopped before encryption was launched. A key technical shift was the adoption of **virtual-machine-based encryption** to bypass endpoint defenses. In a Sophos-investigated case, Maze failed twice after security software blocked ransomware launched through scheduled tasks, then succeeded in deploying an **MSI** package that installed **VirtualBox** and a customized **Windows 7** VM, mounted host drives, and encrypted files from inside the guest system. That approach mirrored **Ragnar Locker**, which had already used a smaller **Windows XP** VirtualBox image to make encryption appear to come from a trusted process while continuing its broader playbook of RDP-driven access, lateral movement, shadow-copy deletion, service termination, and **Salsa20** plus **RSA-2048** encryption backed by leak-site extortion.
Aug 15, 2026
The **REvil/Sodinokibi** ransomware operation broadened its playbook by combining network-wide encryption with data theft, public leak threats, and dark-web auctions of stolen files. The gang threatened to publish or sell data taken from victims including **GEDIA Automotive Group** and other unnamed companies, sometimes releasing samples such as an Active Directory **AdRecon** report or promising daily disclosures of employee and financial records. REvil also launched an auction site to monetize stolen data from non-paying victims, with opening bids such as **$50,000** in **Monero**, extending the pressure tactics already used in high-profile corporate extortion cases. Intrusions tied to REvil also showed increasingly targeted post-compromise activity. Symantec observed attackers using **Cobalt Strike**, PowerShell, remote access tools, and account creation to move laterally, disable defenses, and deploy ransomware, while also scanning some victim networks for **point-of-sale software** that could enable payment-card theft or prioritize systems for encryption. Reported victims included a New York airport, a New Jersey synagogue, and organizations in services, food, and healthcare, while Microsoft said human-operated ransomware crews were exploiting exposed **RDP**, vulnerable internet-facing systems, and flaws such as **`CVE-2019-19781`** and **`CVE-2019-11510`** before spending weeks or months inside networks prior to encryption.
Aug 15, 2026
The **Maze** ransomware operation evolved from earlier exploit-kit activity associated with “ChaCha ransomware” into a prominent double-extortion threat that stole data before encrypting systems and then pressured victims by publishing stolen files on dedicated leak sites. Operators built a public reputation around naming victims, courting media attention, and using data exposure as leverage to increase the likelihood of ransom payments. Maze infections were delivered through multiple channels, including spam campaigns impersonating government tax agencies and later more targeted compromises through **Remote Desktop Protocol (RDP)** access and network exploitation. Sophos reported that the malware used heavy obfuscation, anti-analysis checks, persistence mechanisms, system and network reconnaissance, **HTTP POST** data exfiltration, and file encryption based on **RSA** and **ChaCha20**, while also showing selective behavior such as adjusting demands for home versus corporate systems and easing pressure in some medical-sector cases during COVID-19.
Jun 29, 2026