Loading malware…
RagnarLocker is a Windows ransomware family and associated criminal operation active since 2020, principally targeting large enterprises and critical-infrastructure organizations, including manufacturing, energy, financial services, government, information technology, and healthcare. It encrypts victim data and employs double extortion by stealing data and threatening public disclosure; operators have also been associated with DDoS-based pressure tactics. The operation has been commonly associated with Viking Spider, while affiliates linked to UNC2447 have also deployed RagnarLocker.
RagnarLocker uses layered packing and obfuscation, including VMProtect and UPX, and performs locale checks that cause execution to stop on systems configured for several CIS-region locales. Before encryption, it collects host-identification information, enumerates storage volumes and services, terminates backup and remote-management services, and deletes Volume Shadow Copies. It selectively excludes system-related directories and executable or system-file types to preserve host operability. File encryption uses symmetric encryption with RSA-2048 protection of encryption material, and encrypted files receive a victim-specific extension and marker.
A notable evasion technique is execution from an attacker-deployed Oracle VirtualBox virtual machine, including a custom Windows XP guest. The virtual machine accesses host files through shared folders, allowing encryption activity to occur from the guest environment and reducing visibility to host-based security products. RagnarLocker incidents have also involved compromise of exposed remote-access infrastructure, including unpatched VPN appliances, followed by enterprise-wide post-compromise activity and ransomware deployment. International law-enforcement action disrupted RagnarLocker infrastructure and arrested suspected participants in 2023.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
A 2021 report by Mandiant notes the group had previously deployed RagnarLocker.
In November 2020, the company announced it was hit by a crippling ransomware attack. The attack was orchestrated by the RagnarLocker group.
32 distinct techniques documented for this family, organized by ATT&CK tactic.
Может распространяться путём взлома через незащищенную конфигурацию RDP...
Может распространяться путём... обманных загрузок... вредоносной рекламы, веб-инжектов, фальшивых обновлений...
Может распространяться путём взлома через незащищенную конфигурацию RDP...
Finally, to execute the txt in the default session in which the RagnarLocker has worked, it performs an Interactive window station in which we will see how it gets the session identifier, the process that is running the Ransomware, duplicate your token, get the session, and so on, to spawn the file in the session
Finally, to execute the txt in the default session in which the RagnarLocker has worked, it performs an Interactive window station in which we will see how it gets the session identifier, the process that is running the Ransomware, duplicate your token, get the session, and so on, to spawn the file in the session
RagnarLocker uses VMProtect, UPX, and custom packing algorithms
Удаляет теневые копии файлов командами: WMIC.exe shadowcopy delete ... vssadmin delete shadows /all /quiet
The malware then attempts to silently delete all Volume Shadow Copies, preventing user recovery of encrypted files, using two different methods: vssadmin delete shadows /all /quiet and wmic.exe.shadowcopy.delete.
“To mask active file-system activity from monitoring tools, ransomware gangs sometimes run the entire encryption process inside a virtual machine deployed on the victim’s computer.”
Ragnar Locker uses Windows API GetLocaleInfoW to identify the location of the infected machine. If the victim location is identified as 'Azerbaijani,' 'Armenian,' 'Belorussian,' 'Kazakh,' 'Kyrgyz,' 'Moldavian,' 'Tajik,' 'Russian,' 'Turkmen,' 'Uzbek,' 'Ukrainian,' or 'Georgian,' the process terminates.
«банды вымогателей иногда разворачивают весь процесс шифрования в установленной на компьютере жертвы виртуальной машине, чтобы замаскировать от мониторинга активную деятельность в файловой системе. Шифровальщик RagnarLocker применял VirtualBox, а в кампании CRON#TRAP использовалась среда QEMU».
After identifying disks to be encrypted, it is dedicated to enumerate services, in which, we can see that it uses the EnumServiceStatusA
as well as the MachineGUID of the computer using the Microsoft RegKey Crypthography or the ProductName using the RegKey Windows NT\Current Version
The binary gathers the unique machine GUID, operating system product name, and user name currently running the process.
After identifying disks to be encrypted... Later, it will try to encrypt the files avoiding some folders, files and extensions that it will also check in memory, avoiding touching what it does not need to encrypt
RagnarLocker identifies all attached hard drives using Windows APIs: CreateFileW, DeviceIoControl, GetLogicalDrives, and SetVolumeMountPointA.
“To mask active file-system activity from monitoring tools, ransomware gangs sometimes run the entire encryption process inside a virtual machine deployed on the victim’s computer.”
Ragnar Locker uses Windows API GetLocaleInfoW to identify the location of the infected machine. If the victim location is identified as 'Azerbaijani,' 'Armenian,' 'Belorussian,' 'Kazakh,' 'Kyrgyz,' 'Moldavian,' 'Tajik,' 'Russian,' 'Turkmen,' 'Uzbek,' 'Ukrainian,' or 'Georgian,' the process terminates.
the Egregor operators stole unencrypted files from the company and leaked a 380MB archive on its darknet leak site
The crooks steal sensitive data, encrypt a victim's systems, and threaten to leak the stolen documents if the ransom to restore the files isn't paid. To date, the Ragnar Locker criminals have posted stolen data from at least ten organizations on their publicity website.
“ransomware gangs sometimes run the entire encryption process inside a virtual machine” and “RagnarLocker ransomware strain has used VirtualBox for this purpose.”
Перед шифрованием завершает работу следующих служб, среди которых есть программы для удаленного управления: vss sql memtas mepocs sophos veeam... | в случае совпадения вредонос прекратит работу ("TerminateProcess") с кодом ошибки 0x29A.
Удаляет теневые копии файлов командами: WMIC.exe shadowcopy delete ... vssadmin delete shadows /all /quiet
Triple extortion follows a straightforward formula: adding DDoS attacks to the aforementioned encryption and data exposure threats.
41 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Other indicator types observed in public reporting.
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware that can use a VirtualBox virtual machine to perform file encryption, helping mask intensive filesystem activity from monitoring.
Ransomware strain cited as running its encryption process inside a VirtualBox virtual machine on a victim computer to mask file-system activity from monitoring tools.
Enterprise-focused ransomware that encrypts files, steals data before encryption for extortion, and may use DDoS pressure tactics. The content says it appends .ragnar_<ID> style extensions, drops ransom notes named RGNR_<ID>.txt, deletes shadow copies, terminates backup/remote-management services, avoids CIS locales, and in some campaigns used a VirtualBox Windows XP VM to evade host-based antivirus during encryption.
Ransomware family listed among malicious activity associated with ISPsystem-derived hostnames.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.