Cyber Threat Actor: Ranzy Locker

RanzyLocker, also tracked as Ranzy, is a ransomware threat actor that has been publicly associated with attacks on French municipal entities. The actor’s known aliases include Ranzy Locker and Ranzy, and open‑source reporting notes a possible Russian origin, though no further geographic detail is confirmed. Observed activity indicates a focus on local government targets within France, specifically town hall administrations and related municipal services. The actor’s apparent objective is financial gain, as demonstrated by ransom demands made in Bitcoin in exchange for decryption keys following data encryption.

The actor’s tactics, techniques, and procedures include the deployment of the Ranzy ransomware malware family, which performs data exfiltration prior to encrypting files on compromised networks. In the reported incidents, the ransomware was used to render municipal computer systems inaccessible, after which victims received a ransom note demanding payment in Bitcoin for a decryption key. The exfiltration‑then‑encryption approach suggests a double‑extortion style, although no additional tooling or initial‑access vectors are described in the available sources. No specific exploit kits, phishing methods, or privilege‑escalation tools are mentioned in the provided material.

Publicly reported operations attributed to Ranzy Locker include the November 2020 ransomware attack on the Alfortville town hall, which disrupted administrative operations and prompted a Bitcoin ransom demand, and the January 2021 cyberattack on the city of Houilles that paralyzed its website, email systems, and digital request‑processing services. These incidents illustrate the actor’s capacity to impact essential municipal functions and to leverage ransomware for monetary extortion. While the attacks are linked to the same threat actor cluster, no broader campaign pattern, affiliate network, or state sponsorship is detailed in the existing information.