Ragnar Locker

Description

Ragnar Locker is a ransomware as a service operation active from 2020 until law enforcement seized its infrastructure in 2023, and it targeted companies in critical sectors around the world. Its encryptor ran inside a hidden virtual machine to evade host based security, and its affiliates exfiltrated data before encryption and pressured victims through a leak site. Its takedown, which included the arrest of an alleged developer, showed how international coordination can disrupt established ransomware brands.

Stats

First seen: February 2022
Last seen: October 2026

Also known as

RagnarLockerRagnarlocker

MITRE ATT&CK techniques

13 techniques across 6 tactics.

TA0002 Execution

T1059Command and Scripting Interpreter
- T1059.003Windows Command Shell
T1569System Services
- T1569.002Service Execution

TA0003 Persistence

T1543Create or Modify System Process
- T1543.003Windows Service

TA0005 Stealth

T1218System Binary Proxy Execution
- T1218.010Regsvr32
- T1218.007Msiexec
- T1218.011Rundll32
T1564Hide Artifacts
- T1564.006Run Virtual Instance

TA0007 Discovery

T1120Peripheral Device Discovery
T1614System Location Discovery

TA0040 Impact

T1486Data Encrypted for Impact
T1489Service Stop
T1490Inhibit System Recovery

TA0112 Defense Impairment

T1685Disable or Modify Tools

Associated groups

G0061FIN8

Alert name variants

Alert Name	Engine
Gen:Variant.Ransom.RagnarLocker.17	AV
Linux.Ransomware.RagnarLocker	ATP Sandbox Adv. Heuristics
Win32.Ransomware.Ragnarlocker	ATP Sandbox Adv. Heuristics
Win32.Ransomware.RagnarLocker	ATP Sandbox Adv. Heuristics

Related IPS Signatures

Signature Name	Engine
MALWARE-OTHER Win.Ransomware.RagnarLocker initial download	IPS-SWG