Day 12: Ragnar Locker Ransomware

Threat actors compromise the company’s network using the Remote Desktop Protocol (RDP) service, brute force their way into the networks by either guessing weak passwords or using stolen login information purchased on the dark web. The attackers then conduct a second stage reconnaissance and exploit the CVE-2017-0213 vulnerability in the Windows COM Aggregate Marshaler to run arbitrary code to elevate privileges. Attackers deploy a VirtualBox virtual machine (VM) with a Windows XP image to avoid detection after achieving privilege escalation. The attackers load the VM image to the VirtualBox VM, mapping all local drives into the virtual machine allowing the ransomware to encrypt all the files. The threat operators then delete any extant shadow copies, disable any antivirus countermeasures, and use PowerShell scripts to move the ransomware from one company network asset to another. The attackers steal sensitive files and upload them to their servers before deploying Ragnar Locker ransomware. Ragnar Locker also goes to the extent of eliminating remote admin tools within an environment restricting remote IT from being able to gain access. Ragnar Locker remotely administrates networks by repeating the running services and terminating services used by managed service providers (MSPs). They become unresponsive when contacted by professional negotiation firms.