⚠️ Overview

Ransoc is a ransomware strain first identified in November 2017 by NCC Group, targeting professional services firms such as law and accounting offices. It belongs to the double-extortion ransomware category, encrypting files and exfiltrating sensitive data before demanding payment.

🔧 Technical Capabilities

Ransoc typically propagates via phishing emails containing malicious Microsoft Office attachments or through compromised Remote Desktop Protocol (RDP) credentials. Upon execution, it deploys PowerShell scripts to download secondary payloads and uses WMI to enumerate domain-joined systems for lateral movement. The malware encrypts files with AES-256 and appends the .RANSOC extension, while simultaneously exfiltrating data to a command-and-control (C2) server over HTTPS. Persistence is achieved by creating scheduled tasks named RansocUpdater or modifying registry run keys. To evade detection, the malware obfuscates its PowerShell code, disables Windows Defender, and deletes volume shadow copies.

📜 History & Notable Incidents

Ransoc first appeared in November 2017, documented in a report by NCC Group's Global Managed Security Services team. Notable campaigns targeted UK-based law firms in 2018 and US accounting firms in 2019, with attackers leaking stolen client data on dark web forums after victims refused to pay. No law enforcement takedowns or specific CVEs have been publicly associated with this malware.

🔍 Detection Indicators

Known file hashes for early Ransoc samples have been published by NCC Group in their advisory, along with behavioral indicators including the ransom note README_TO_DECRYPT.txt and the .RANSOC file extension. Network IOCs involve communication with IP addresses hosted on bulletproof providers in Eastern Europe, and persistence is indicated by the scheduled task RansocUpdate or the registry key HKCUSoftwareMicrosoftWindowsCurrentVersionRunRansoc.

☠️ Risk & Impact

Ransoc causes severe operational disruption and data loss through file encryption, while the threat of data exposure leads to regulatory fines and reputational damage. The most affected sectors are legal services, accounting, and healthcare, with ransom demands typically between 1 and 10 Bitcoin (approximately $10,000–$100,000 at the time of attack).

🛡️ Mitigation

Recommended countermeasures include implementing multi-factor authentication on all remote access, maintaining air-gapped backups, and restricting PowerShell script execution to signed scripts. NCC Group provides YARA and Snort rules for detection, and organizations should deploy endpoint detection and response (EDR) tools with behavioral analytics.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.