Loading threat actor…
Ragnar Locker is a Russian-speaking organized cybercriminal ransomware operation active since at least late 2019 or early 2020 and widely associated with double-extortion attacks against large enterprises and critical infrastructure organizations. The group is also referred to as RagnarLocker and has been linked in some reporting to the alias Viking Spider. It has targeted organizations in sectors including manufacturing, energy, financial services, government, information technology, and health-related organizations, with notable victimization in the United States and Japan. Ragnar Locker typically conducts targeted intrusions rather than indiscriminate mass deployment. Reported access methods include abuse of exposed remote access services, exploitation of vulnerable perimeter devices, and cooperation with external penetration testers or access providers. After gaining access, the operators perform reconnaissance, move laterally, terminate security, backup, database, and remote-management processes and services, delete shadow copies, disable recovery features, and encrypt files while also stealing data for extortion. The group has repeatedly threatened to publish stolen information on leak infrastructure when victims refuse to pay, and has at times offered decryption together with deletion of exfiltrated data. The malware is notable for anti-analysis and defense-evasion features including packing and debugger interference, as well as locale checks that cause execution to terminate on systems configured for multiple CIS and neighboring languages. Ragnar Locker has also been associated with virtualization-based deployment to evade host defenses, including running ransomware from a guest virtual machine mounted against host drives. Technical reporting describes its use of Salsa20-based file encryption with RSA public-key protection of per-file key material, drive and volume enumeration, forced mapping of volumes, process and service termination, and ransom notes customized for specific victims. Operationally, Ragnar Locker was an early adopter of aggressive extortion tactics beyond encryption. The group used leak sites, data-theft extortion, and DDoS pressure against victims, and has been associated with public pressure campaigns such as social-media advertising aimed at coercing payment. It was also described as participating in the loosely branded “Maze Cartel” alongside Maze and LockBit for shared victim-publicity efforts, though reporting indicates this was more a cooperative marketing and leak-publication arrangement than a unified organization. Separate reporting noted some form of affiliation with Mount Locker, but not membership in Mount Locker’s ransomware-as-a-service structure. Law-enforcement actions in 2023 disrupted parts of the operation, including seizure of infrastructure and arrests of suspected members or associates across Europe. Despite those disruptions, Ragnar Locker remains a significant historical ransomware actor because of its role in popularizing double extortion, virtualization-assisted deployment, and coercive pressure tactics against enterprise victims.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
46 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 malware families attributed to this actor across reporting.
24 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware operators conducting big-game extortion against large companies and business users, encrypting files and stealing data beforehand for leak-based pressure, with additional use of DDoS coercion. The content also describes their use of a VirtualBox Windows XP VM to evade host-based antivirus during encryption.
Mentioned only as a previously linked Russia-aligned threat actor in background context about RansomHouse.
Conducted a ransomware attack against TAP Air Portugal and later leaked compromised data on a public dark web site.
Ransomware activity associated with the WIN-344VU98D3RU ISPsystem-derived hostname.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.