Radar
A ransomware group, also called Dispossessor, disrupted in August 2024 by the FBI, the UK's National Crime Agency and German authorities. It targeted small and medium-sized organisations using weak passwords and missing two-factor authentication.
Threat actor profile. Last reviewed 3 November 2026.
Why It Matters
The US Department of Justice says domains, servers and IP addresses linked to the group were disabled in August 2024, with related domains and servers also disabled in the UK and Germany. The National Crime Agency was one of the investigating agencies. The defendant is known as "Brain" and is believed to be based in Europe.2
UK links are direct. Tech Monitor reports three servers disrupted in the UK and lists the UK among countries with victims.3
The FBI says the group targeted small and medium-sized organisations. If a company did not respond, it contacted other employees by email or phone, including links to videos showing stolen files.1
The takedown removed infrastructure, and the sources reviewed report no arrests. The way in, weak passwords without two-factor authentication, remains common. We would treat that as the lasting lesson.
How It Attacks
Based on FBI statements reported in August 2024.1
- 1
Get In
Exploits vulnerable systems, weak passwords and missing two-factor authentication.
- 2
Gain Control
Obtains administrator rights and accesses files.
- 3
Steal and Encrypt
Steals data and encrypts systems.
- 4
Apply the Pressure
Contacts other employees by email or phone, with links to videos of the stolen files.
Key Techniques
Our mapping of the behaviour the FBI describes.1 Radar has no ATT&CK v20 entry.
Defences That Matter
Protect Remote Access
- Require phishing-resistant MFA on VPN, RDP and administrator accounts.
- Remove internet-facing RDP where possible and review dormant accounts.
Patch What Faces the Internet
- Keep an accurate list of internet-facing systems and patch them first.
- Prioritise VPN appliances, file transfer tools and web applications.
Plan for Extortion
- Decide in advance who handles legal, regulatory and client communication if data is published.
- Rehearse a data theft scenario where backups do not solve the problem.
Are Weak Passwords Still Your Way In?
We can review your remote access and identity controls and help you close the gaps.
Sources
- Silicon Republic: Dangerous ransomware sites shut down by FBI, 13 August 2024
- US Attorney's Office, Northern District of Ohio: Websites seized in multi-national ransomware takedown, 12 August 2024
- Tech Monitor: FBI takes down Radar/Dispossessor ransomware group, 13 August 2024
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK terms of use.