The FBI claimed in a flash advisory that at least 52 critical infrastructure orgs have been breached by the threat actor group as of January 2022. The affected entities included vitality, fiscal services, federal govt, and IT sectors, the bureau said.
Ragnar Locker operators evade detection by using terminate remote management software (ConnectWise, Kaseya) to control clients’ systems from afar on compromised enterprise endpoints.
The FBI added that it doesn’t encourage paying Ragnar Locker ransoms since victims have no guarantee that paying will prevent leaks of stolen data or future attacks.