With just a touch of bravado, the European Union Agency for Law Enforcement Cooperation (or Europol) has announced “a major blow” to the Ragnar Locker ransomware group. To you and me, that name is mostly familiar because of the organisation’s 2020 attack on Capcom, which saw it demand $11 million and affect around 400,000 people’s data.
To Europol, Ragnar Locker was more notable for its attacks on “critical infrastructure” around the world, most recently “against the Portuguese national carrier and a hospital in Israel.”
A “key target” of police agencies investigating Ragnar Locker was arrested in Paris on the 16th of October following an “international police swoop” that also saw ransomware infrastructure seized in the Netherlands, Germany, and Sweden.
Five more suspects have been interviewed in Spain and Latvia and, as if all that wasn’t enough, the “main perpetrator,” suspected by police of being one of the group’s devs, was brought before the Paris Judicial Court at the end of “the action week” (or last week, to those of us not participating in international manhunts).
Ragnar Locker was—and perhaps may continue to be, depending on just how fatal a blow this was—some pretty nasty stuff. Per Europol, it worked by targeting Windows devices and “would typically exploit exposed services like Remote Desktop Protocol” to gain control over victims’ systems. Once it had wormed its way in, the ransomware group would “employ a double extortion tactic, demanding extortionate payments for decryption tools as well as for the non-release of sensitive data.” Victims were explicitly warned not to ask for outside help. If they did, the group threatened to publish its stolen data on a dark web “Wall of Shame.”
But Europol says that site—based in Sweden—is down, at least for now, following an operation coordinated by itself and Eurojust with the involvement of 11 international law enforcement bodies, including the US FBI. In a statement to the press, Europol’s European Cybercrime Centre head Edvardas Šileris said he hoped “this round of arrests sends a strong message to ransomware operators who think they can continue their attacks without consequence.”