Ragnarok, a ransomware gang that has been operating since 2019 and became known after attacking old Citrix ADC servers, has shut down and released a free decryption key to victims.
I did “work” for 40 million
The gang, also known as Asnarok, last week replaced all 12 victims listed on the group’s dark web portal, with brief instructions on how to decrypt the files. This was accompanied by an attached decryption file containing the master decryption key. Security company Emsisoft, known for helping ransomware victims encrypt data, has released a global Ragnarok ransomware decryption program.
Same vulnerability as WannaCry
According to her “Business Portal”, Ragnarok has done “business” more than 4.5 million dollars – about 40 million kronor. They exploited the same loophole behind the infamous WannaCry attack I 2017.
In April 2020, Ragnarok stole ten terabytes of data from Portuguese energy giant EDP and threatened to leak it unless they received a $10.9 million ransom. They filtered up to two terabytes of bank statements, employee information and celebrity deals from the servers of Italian liquor giant Campari and demanded a $15 million ransom.
In November, Ragnarok attacked Capcom, the Japanese video game producer behind titles such as Street Fighter, Resident Evil and Devil May Cry.
Without any formal resignation note, it is unclear why Ragnarok apparently decided to say stop. But they are not alone, we have also seen other ransom gangs working on self-destruction; RevelThe gang behind the GPS attack has mysteriously disappeared from the internet. The dark sideThe gang behind the colonial pipeline attack also announced that it was withdrawing.
Other ransomware gangs such as Ziggy Avaddon, SynAck and Fonix pulled this year from hacking and released encryption keys to help victims get back on their feet.
The infamous DoppelPayment gang disappeared and then re-emerged as the Grief ransomware after several months of silence. It remains to be seen if Ragnarok will rise from the dead.
Earlier this year, ITavisen wrote: References to ransomware as a pandemic: 102 percent increased
“Web specialist. Lifelong zombie maven. Coffee ninja. Hipster-friendly analyst.”