{
	"id": "7ef70e9b-e42a-4750-83ee-d51c8098ed92",
	"created_at": "2026-04-06T03:36:45.362411Z",
	"updated_at": "2026-04-10T13:12:42.128335Z",
	"deleted_at": null,
	"sha1_hash": "b574d0d1e255f78877626c4d9f7f68ba8421631e",
	"title": "Ragnar Locker Targets CWT in Ransomware Attack",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 128111,
	"plain_text": "Ragnar Locker Targets CWT in Ransomware Attack\r\nBy Orlaith Traynor\r\nPublished: 2020-07-31 · Archived: 2026-04-06 03:22:54 UTC\r\nHome | Blog | Ragnar Locker Targets CWT in Ransomware Attack\r\nRagnar Locker strikes again. CWT, formerly Carlson Wagonlit Travel and fifth largest travel management firm,\r\nconfirmed a cyber attack, which it said occurred the weekend of July 26-27, 2020. According to Threatpost, CWT\r\nstated, “We can confirm that after temporarily shutting down our systems as a precautionary measure, our systems\r\nare back online and the incident has now ceased.” Ragnar Locker initiated the ransomware attack and may have\r\nstolen 2 terabytes of data, allegedly including thousands of global executives credentials. This is particularly\r\nworrisome given CWT provides travel services to as much as 33% of the Fortune 500.  The ransomware criminals\r\nthen demanded a $10 million dollar ransom in exchange for a commitment not to publicly release the stolen data.\r\nTo demonstrate the seriousness of their threat, Ragnar Locker showed CWT a password-protected press release on\r\na hidden part of their website. It appears CWT negotiated down the ransom amount, citing a recent downturn in\r\ntheir business resulting from the COVID-19 crisis. Ragnar Locker committed not to publish the stolen\r\ninformation, and even shared tips to avoid future hacks, after a final payment of $4.5 million dollars was paid in\r\nhttps://cybelangel.com/blog/ragnar-locker-targets-cwt/\r\nPage 1 of 2\n\nbitcoin (414).\r\nSubsequent to the payment, Ragnar Locker held up their end of the bargain, providing credentials to access a\r\nMEGA Cloud drive where CWT’s stolen data was held and removing the press announcement from their private\r\nwebsite. Ragnar Locker even shared tips to avoid future hacks including information that no antivirus can avoid\r\nsuch an infection, but better internal policies may.\r\n CybelAngel\r\ninvestigated this ransomware incident after an independent security analyst uncovered a malware sample citing\r\nCWT as a victim of the Ragnar cryptolocker and exposed this ransomware exploit on Twitter to his 23,000\r\nfollowers. According to exchanges we were able to read between CWT and Ragnar, credentials to access the\r\nstolen data on a MEGA Cloud drive were shared to the victim. CybelAngel cannot confirm whether the\r\ndocuments were deleted in time or if a third party was able to retrieve them beforehand. We continue monitoring\r\nthe situation and scanning for sensitive data from this incident which may be exposed on the internet. CybelAngel\r\ndetects data leaks across the internet far beyond the Surface and Deep/Dark Web to include connected storage,\r\ncloud apps, open databases, et al. Only with the proprietary combination of machine learning and expert cyber\r\nanalysis, can CybelAngel detect data leaks quickly enough to avert catastrophic data breaches. \r\nSource: https://cybelangel.com/blog/ragnar-locker-targets-cwt/\r\nhttps://cybelangel.com/blog/ragnar-locker-targets-cwt/\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://cybelangel.com/blog/ragnar-locker-targets-cwt/"
	],
	"report_names": [
		"ragnar-locker-targets-cwt"
	],
	"threat_actors": [],
	"ts_created_at": 1775446605,
	"ts_updated_at": 1775826762,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/b574d0d1e255f78877626c4d9f7f68ba8421631e.pdf",
		"text": "https://archive.orkl.eu/b574d0d1e255f78877626c4d9f7f68ba8421631e.txt",
		"img": "https://archive.orkl.eu/b574d0d1e255f78877626c4d9f7f68ba8421631e.jpg"
	}
}