Sophos, a British cybersecurity firm, has announced a new ransomware virus called Ragnar Locker, which runs a virtual machine to access users ' files and bypass antivirus programs.
Experts in the field of information security noted that by running a virtual machine, Ragnar Locker bypasses antivirus software and encrypts files. In this case, the encryption virus usually attacks corporate networks, not private users.
Hackers require is really an impressive amount for the decryption of files. So, for the code to decrypt the data of Energias de Portugal, they asked for 1,850 BTC (about $17 million at the current exchange rate). In case of refusal to pay bitcoins, the attackers threatened to sell the company's corporate secrets to competitors.

Sophos experts said that the virus uses vulnerabilities in the Windows remote desktop system to infect the computer. After receiving administrative privileges, Ragnar Locker starts a VM with a stripped-down copy of Windows XP called "Micro XP v0.82".

"Operators have discovered a new ransomware virus that uses a virtual machine to bypass computer security products. Like other similar viruses, Ragnar Locker steals data to convince the victim to pay a ransom. If the ransom is not paid, the data is published on the group's website in the anonymous Tor network, " said Brett Callow, a cybersecurity specialist from Emsisoft.

He also stressed that companies that have been attacked by such viruses are in an unenviable position. Even when paying a ransom, they only have the hackers ' promise that they will not publish or sell the data they received.

Recall that the other day the company Group-IB reported a new virus - the cryptographer ProLock, which requires a ransom in bitcoins for decrypting files. However, unlike Ragnar Locker, ProLock does not steal user data for subsequent blackmail.