Security Experts:

Connect with us

Hi, what are you looking for?


Application Security

FBI Publishes Indicators of Compromise for Ranzy Locker Ransomware

The Federal Bureau of Investigation (FBI) this week released a Flash report to publicly share indicators of compromise (IOCs) for the Ranzy Locker ransomware.

The Federal Bureau of Investigation (FBI) this week released a Flash report to publicly share indicators of compromise (IOCs) for the Ranzy Locker ransomware.

The ransomware has been targeting businesses in the United States since late 2020 and, by July 2021, compromised more than 30 victims in the information technology, transportation sector, the construction subsector of critical manufacturing, and the academia subsector of government facilities.

A typical attack starts with brute forcing Remote Desktop Protocol (RDP) connections to gain initial access to the network. Recently, the adversary exploited known Microsoft Exchange Server vulnerabilities and phishing messages for initial access.

During the attack, the Ranzy Locker operators would also attempt to identify important files for exfiltration, including customer data, Personally Identifiable Information, and financial records, the FBI said i the report.

Next, the ransomware is deployed to encrypt files on Windows host systems (servers and virtual machines included), as well as on attached network shares. A ransom note is then deployed in each of the directories containing encrypted files.

Victims are instructed to pay a ransom in exchange for a decryption tool, but the operators may also attempt to extort a second ransom, threatening to make the stolen data public.

 [READ: FBI Warns Ransomware Attack Could Disrupt Food Supply Chain ]

The ransomware also deletes all of the backups found on the compromised machine and attempts to infect other systems on the local network.

According to the FBI, the IOCs associated with Ranzy Locker include the creation of new user accounts with the name “felix” on domain controllers, active directories, servers, and workstations; a ransom note that shows wording similarities with AKO and ThunderX ransom notes; and the .ranzy extension is appended to encrypted files; among other.

The FBI also listed a series of recommended mitigations for keeping systems protected from ransomware, such as updating applications and operating systems periodically, keeping all data backed up offline, implementing network segmentation and the lead privileged policies, reviewing logs and auditing user accounts, implementing multi-factor authentication, and disabling unused protocols, such as RDP.

Related: FBI Warns Ransomware Attack Could Disrupt Food Supply Chain

Related: CISA, FBI Warn of Increase in Ransomware Attacks on Holidays

Related: FBI Shares IOCs for ‘Hive’ Ransomware Attacks

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.


Websites of German airports, administration bodies and banks were hit by DDoS attacks attributed to Russian hacker group Killnet

Data Breaches

GoTo said an unidentified threat actor stole encrypted backups and an encryption key for a portion of that data during a 2022 breach.

Network Security

NSA publishes guidance to help system administrators identify and mitigate cyber risks associated with transitioning to IPv6.

CISO Strategy

Cybersecurity-related risk is a top concern, so boards need to know they have the proper oversight in place. Even as first-timers, successful CISOs make...


The North Korean APT tracked as TA444 is either moonlighting from its previous primary purpose, expanding its attack repertoire, or is being impersonated by...


The FBI dismantled the network of the prolific Hive ransomware gang and seized infrastructure in Los Angeles that was used for the operation.

Management & Strategy

Industry professionals comment on the recent disruption of the Hive ransomware operation and its hacking by law enforcement.