European Police Nab Developer of Ragnar Locker Ransomware

20.10.2023 - 16:36 / pcmag.com

Police across Europe may have dealt a major blow to the cybercriminal gang behind the ransomware strain Ragnar Locker. 

Europol today announced it had arrested a suspected developer of Ragnar Locker, a day after law enforcement seized the gang's main website, which was used to leak stolen data.

"The 'key target' of this malicious ransomware strain was arrested in Paris, France, on 16 October, and his home in Czechia was searched," Europol said. The main suspect has since been brought before a Paris judicial court for examination. 

In addition, European investigators interviewed five other suspects in Spain and Latvia. Police also seized the gang’s server infrastructure in the Netherlands, Germany, and Sweden. Another raid was conducted in Kyiv, Ukraine, “in the premises of one of the members of the group,” the Cyber Police of Ukraine said.

According to Europol, Ragnar Locker has been active since December 2019. The gang allegedly attacked at least 168 companies across the US and Europe by spreading the Ragnar Lock ransomware, which can encrypt entire fleets of computers. 

In 2020, the group grabbed headlines for infecting servers at Japanese video game developer Capcom by exploiting an old VPN device at the company’s California HQ. Europol adds that the Ragnar Locker gang is also responsible for attacking critical infrastructure providers, including a Portuguese airline and a hospital in Israel. 

“Attackers infected servers with malware and stole information from them,” Ukraine’s Cyber Police said. “For the restoration of access, the members of the group demanded from 5 to 70 million dollars in cryptocurrency. In case of failure to pay the ransom or contact the law enforcement officers, they threatened to distribute the stolen data on the darknet.”

It remains unclear if Ragnar Locker had any other developers working for the gang. So it’s possible the group could revive itself, since there’s some circumstantial evidence suggesting at least some Ragnar Locker members reside in Russia. Europol didn’t immediately respond to a request for comment.

Sign up for SecurityWatch newsletter for our top privacy and security stories delivered right to your inbox.

This newsletter may contain advertising, deals, or affiliate links. Subscribing to a newsletter indicates your consent to our Terms of Use and Privacy Policy. You may unsubscribe from the newsletters at any time.

Your subscription has been confirmed. Keep an eye on your inbox!