Ragnarok
According to Bleeping Computer, the ransomware is used in targeted attacks against unpatched Citrix servers. It excludes Russian and Chinese targets using the system's Language ID for filtering. It also tries to disable Windows Defender and has a number of UNIX filepath references in its strings. Encryption method is AES using a dynamically generated key, then bundling this key up via RSA.
Threat level
LOW
Get an alert if one of your domains is named on a ransomware leak site.
Known infrastructure
The following Tor hidden services have been associated with this group:
wobpitin77vdsdiswr43duntv6eqw4rvphedutpaxycjdie6gg3binad.onionDecrypt Site
These sites are malicious. Open them only from an isolated environment.
Check if you’re affected
Look up your domain to see whether it appears on Ragnarok’s victim list.
risk score · threat categories · sources · age · confidence — in one request