Ragnar Locker Ransomware Attacks Energy Company, Potentially Stealing 10TB in Data



ransomware ragnar locker attackIn a letter to customers, EDP Renewables North America CEO acknowledges the attack occurred back in April of this year, but claims “no evidence” of data theft exists.

The ransomware “note” demanded approximately $10 million in Bitcoin. It also included a warning that over 10TB of information had been exfiltrated from encrypted systems, offering to decrypt some of the impacted files for free as a demonstration of their claim. EDP declined to pay the ransom and data has yet to be published.

This attack demonstrates a few things. First, it shows how pervasive ransomware can be. The attack started in the network of EDP Renewable’s parent company, Energias de Portugal in April, with their American subsidiary learning about the attack in early May. Second, it shows how integrated the idea of stealing data as part of a ransomware attack (whether actual or simply claimed) is becoming the norm. I’ve talked about the Maze “cartel” before – there are are plenty of ransomware gangs that partake in the “steal-and-publish” ransomware method. But, it appears, thus far, that in the case of the attack in EDP, it’s merely a statement meant to improve the chances of payment.

There is no detail on how many systems were impacted, but judging by the claim of 10TB, one would assume at least 10TB of data was encrypted, implying a number of critical systems were affected.

Avoiding this kind of attack is the only good advice I can offer; even if you don’t (and shouldn’t) pay the ransom, it will be days-to-weeks to see operations return to normal. Security Awareness Training is one of the most effective ways to stop user-targeted attacks. By educating the user on what to look for, avoiding malicious email and web content becomes second nature, stopping ransomware and other attacks before they even start.


Free Ransomware Simulator Tool

Bad guys are constantly coming out with new strains to evade detection. Is your network effective in blocking all of them when employees fall for social engineering attacks?

KnowBe4’s "RanSim" gives you a quick look at the effectiveness of your existing network protection. RanSim will simulate 18 ransomware infection scenarios and 1 cryptomining infection scenario and show you if a workstation is vulnerable.

RanSimScreen-1Here's how it works:

  • 100% harmless simulation of real ransomware and cryptomining infections
  • Does not use any of your own files
  • Tests 19 types of infection scenarios
  • Just download the install and run it 
  • Results in a few minutes!

Get RanSim!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

https://www.knowbe4.com/ransomware-simulator

Subscribe To Our Blog


New call-to-action




Get the latest about social engineering

Subscribe to CyberheistNews