www.cisa.gov Open in urlscan Pro
2a02:26f0:7100:1b8::447a  Public Scan

URL: https://www.cisa.gov/uscert/ncas/current-activity/2022/03/08/fbi-releases-indicators-compromise-ragnarlocker-ransomware
Submission: On March 08 via api from US — Scanned from DE

Form analysis 3 forms found in the DOM

GET https://search.us-cert.gov/search

<form accept-charset="UTF-8" action="https://search.us-cert.gov/search" class="hidden-xs searchbox" method="get"><input name="utf8" type="hidden" value="✓"><input id="affiliate-desktop" name="affiliate" type="hidden" value="us-cert">
  <div class="form-group"><label class="sr-only" for="query-desktop">Enter Search Terms(s):</label>
    <div class="input-group"><input autocomplete="off" class="form-control form-control-custom input-lg" id="query-desktop" name="query" placeholder="Search" type="text">
      <div class="input-group-addon input-group-addon-custom"><button class="submit input-lg"><img alt="search icon" data-entity-type="" data-entity-uuid="" src="/sites/default/files/cert/search-icon.png" title="search icon"></button></div>
    </div>
  </div>
</form>

GET https://search.us-cert.gov/search

<form accept-charset="UTF-8" action="https://search.us-cert.gov/search" class="hidden-lg hidden-md searchbox" method="get"><input name="utf8" type="hidden" value="✓"><input id="affiliate-mobile" name="affiliate" type="hidden" value="us-cert">
  <div class="form-group"><label class="sr-only" for="query-mobile">Enter Search Terms(s):</label>
    <div class="input-group"><input autocomplete="off" class="form-control form-control-custom input-lg" id="query-mobile" name="query" placeholder="Search" type="text">
      <div class="input-group-addon input-group-addon-custom"><button class="submit input-lg"><img alt="search icon" data-entity-type="" data-entity-uuid="" src="/sites/default/files/cert/search-icon.png" title="search icon"></button></div>
    </div>
  </div>
</form>

https://public.govdelivery.com/accounts/USDHSCISA/subscribers/qualify

<form action="https://public.govdelivery.com/accounts/USDHSCISA/subscribers/qualify"><label class="visually-hidden" for="email-address-field">Enter your email address</label> <input class="signup-form" id="email-address-field" name="email"
    placeholder=" Enter your email address" title="Enter your email address" type="text"><br><input class="btn btn-primary" name="submit" title="Sign up for alerts" type="submit" value="Sign Up">&nbsp;</form>

Text Content

Skip to main content

An official website of the United States government Here's how you know

Official websites use .gov
A .gov website belongs to an official government organization in the United
States.
Secure .gov websites use HTTPS
A lock () or https:// means you've safely connected to the .gov website. Share
sensitive information only on official, secure websites.
Enter Search Terms(s):

CISA.gov Services Report

--------------------------------------------------------------------------------

Toggle navigation

Enter Search Terms(s):

CISA.gov
Services
Report


CERTMAIN MENU

 * Alerts and Tips
 * Resources
 * Industrial Control Systems
 * Report

--------------------------------------------------------------------------------


TLP:WHITE
TLP:WHITE
 1. National Cyber Awareness System    >
 2. Current Activity    >
 3. FBI Releases Indicators of Compromise for RagnarLocker Ransomware


FBI RELEASES INDICATORS OF COMPROMISE FOR RAGNARLOCKER RANSOMWARE

Original release date: March 08, 2022


The Federal Bureau of Investigation (FBI) has released a Flash report detailing
indicators of compromise (IOCs) associated with ransomware attacks by
RagnarLocker, a group of a ransomware actors targeting critical infrastructure
sectors.

CISA encourages users and administrators to review the IOCs and technical
details in FBI Flash CU-000163-MW and apply the recommended mitigations.

This product is provided subject to this Notification and this Privacy & Use
policy.

Please share your thoughts.

We recently updated our anonymous product survey; we'd welcome your feedback.


LATEST ALERTS

 * Destructive Malware Targeting Organizations in Ukraine
   Saturday, February 26, 2022
 * Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global
   Government and Commercial Networks
   Thursday, February 24, 2022
 * New Sandworm Malware Cyclops Blink Replaces VPNFilter
   Wednesday, February 23, 2022

More Alerts »


RECENT VULNERABILITIES

 * VU#119678: Samba vfs_fruit module insecurely handles extended file attributes
   Tuesday, March 1, 2022 at 8:17 AM
 * VU#796611: InsydeH2O UEFI software impacted by multiple vulnerabilities in
   SMM
   Friday, February 25, 2022 at 1:42 PM
 * VU#229438: Mobile device monitoring services do not authenticate API requests
   Thursday, February 24, 2022 at 3:23 PM
 * VU#383864: Visual Voice Mail (VVM) services transmit unencrypted credentials
   via SMS
   Thursday, February 24, 2022 at 2:20 PM
 * VU#930724: Apache Log4j allows insecure JNDI lookups
   Monday, February 7, 2022 at 8:18 AM

More Vulnerability Notes »


CONTACT US

(888)282-0870

Send us email(link sends email)

Download PGP/GPG keys

Submit website feedback


SUBSCRIBE TO ALERTS

Receive security alerts, tips, and other updates.

Enter your email address
 


HSIN
Report

--------------------------------------------------------------------------------

Home   Site Map   FAQ   Contact Us   Traffic Light Protocol   PCII  
Accountability   Disclaimer   Privacy Policy   FOIA   No Fear Act  
AccessibilityPlain WritingPlug-ins   Inspector General   The White House  
USA.gov
 

CISA is part of the Department of Homeland Security