Ranion targets Windows OS and is distributed through the Ransomware-as-a-Service (RaaS) business model. Although its developer claims that Ranion exists only “for educational purposes,” it is still being sold at a profit as anyone can buy into this distribution network at the cost of 0.95 Bitcoin per year or 0.6 Bitcoin every six months. The Ranion creator does not take a percentage from the distributor’s profit generated from the payment of ransom. This sets Ranion apart from other RaaS campaigns. Each Ranion buyer receives access to the pre-crafted ransomware executable and access to a control panel hosted on a Tor hidden service complete with a dashboard that helps the distributor track infection rates, victim IDs, system usernames, and decryption keys. The developer claims that Ranion is undetectable by 90 percent of antivirus software.
- Bleeping Computer provides more information on Ranion here.
- The NJCCIC is not currently aware of any free decryption tools available for Ranion.