Description
Ragnarok is a ransomware family used in targeted attacks against unpatched Citrix servers. It filters out Russian and Chinese victims using the system language setting, attempts to disable Windows Defender, and encrypts files with AES under a dynamically generated key protected with RSA.
Stats
- First seen
- March 2022
- Last seen
- September 2026
Alert name variants
| Alert Name |
|---|
| Win32.Ransomware.Ragnarok |