Ragnarok
According to Bleeping Computer, the ransomware is used in targeted attacks against unpatched Citrix servers. It excludes Russian and Chinese targets using the system's Language ID for filtering. It also tries to disable Windows Defender and has a number of UNIX filepath references in its strings. Encryption method is AES using a dynamically generated key, then bundling this key up via RSA.
Victims
3
First Discovered
victim2021-03-31
Last Discovered
victim2021-12-30
Inactive Since
more than4 years
Avg Delay
between attack and claimN/A
Infostealer
for victim with domainN/A
Known Locations (2)
Target (Available)
Top 5 Activity Sectors
- Commercial Facilities 1
Top 5 Countries
Heatmap (Available)
Ransom Notes (2)
Tools Used (Not Available)
No tools used available.
Vulnerabilities Exploited (0)
No vulnerabilities exploited available.
TTPs Matrix (0)
No TTPs available.
Negotiation Chats (0)
No negotiation chats available.
YARA Rules (0)
No YARA rules available.
Indicators of Compromise (IoCs) (0)
No IoCs available for this group.
