The Federal Bureau of Investigation (FBI) this week released a Flash report to publicly share indicators of compromise (IOCs) for the Ranzy Locker ransomware.
The ransomware has been targeting businesses in the United States since late 2020 and, by July 2021, compromised more than 30 victims in the information technology, transportation sector, the construction subsector of critical manufacturing, and the academia subsector of government facilities.
A typical attack starts with brute forcing Remote Desktop Protocol (RDP) connections to gain initial access to the network. Recently, the adversary exploited known Microsoft Exchange Server vulnerabilities and phishing messages for initial access.
During the attack, the Ranzy Locker operators would also attempt to identify important files for exfiltration, including customer data, Personally Identifiable Information, and financial records, the FBI said i the report.
Next, the ransomware is deployed to encrypt files on Windows host systems (servers and virtual machines included), as well as on attached network shares. A ransom note is then deployed in each of the directories containing encrypted files.
Victims are instructed to pay a ransom in exchange for a decryption tool, but the operators may also attempt to extort a second ransom, threatening to make the stolen data public.
[READ: FBI Warns Ransomware Attack Could Disrupt Food Supply Chain ]
According to the FBI, the IOCs associated with Ranzy Locker include the creation of new user accounts with the name “felix” on domain controllers, active directories, servers, and workstations; a ransom note that shows wording similarities with AKO and ThunderX ransom notes; and the .ranzy extension is appended to encrypted files; among other.
The FBI also listed a series of recommended mitigations for keeping systems protected from ransomware, such as updating applications and operating systems periodically, keeping all data backed up offline, implementing network segmentation and the lead privileged policies, reviewing logs and auditing user accounts, implementing multi-factor authentication, and disabling unused protocols, such as RDP.
Related: FBI Warns Ransomware Attack Could Disrupt Food Supply Chain
Related: CISA, FBI Warn of Increase in Ransomware Attacks on Holidays

More from Ionut Arghire
- Former Ubiquiti Employee Who Posed as Hacker Pleads Guilty
- Atlassian Warns of Critical Jira Service Management Vulnerability
- Exploitation of Oracle E-Business Suite Vulnerability Starts After PoC Publication
- Google Shells Out $600,000 for OSS-Fuzz Project Integrations
- F5 BIG-IP Vulnerability Can Lead to DoS, Code Execution
- Flaw in Cisco Industrial Appliances Allows Malicious Code to Persist Across Reboots
- HeadCrab Botnet Ensnares 1,200 Redis Servers for Cryptomining
- Malicious NPM, PyPI Packages Stealing User Information
Latest News
- Big China Spy Balloon Moving East Over US, Pentagon Says
- Former Ubiquiti Employee Who Posed as Hacker Pleads Guilty
- Cyber Insights 2023: Venture Capital
- Atlassian Warns of Critical Jira Service Management Vulnerability
- High-Severity Privilege Escalation Vulnerability Patched in VMware Workstation
- Exploitation of Oracle E-Business Suite Vulnerability Starts After PoC Publication
- China Says It’s Looking Into Report of Spy Balloon Over US
- GoAnywhere MFT Users Warned of Zero-Day Exploit
