Loading story…
The FBI and CISA issued a joint FLASH warning that the Ragnar Locker ransomware gang breached at least 52 organizations across 10 U.S. critical infrastructure sectors, including critical manufacturing, energy, financial services, government, and information technology. The agencies said the group has been active since at least late 2019 and uses double extortion, stealing data before encrypting systems and threatening to publish stolen files on its leak site; stolen data from at least 10 victims had already been posted.
The alert detailed Ragnar Locker tradecraft, including use of VMProtect, UPX, and custom packing, deployment from a custom Windows XP virtual machine, locale checks that halt execution on some CIS-region language settings, termination of services and remote management tools such as ConnectWise and Kaseya, deletion of shadow copies, and selective encryption exclusions. The FBI published indicators including infrastructure, IP addresses, Bitcoin wallets, and operator email addresses tied to access, command-and-control, and exfiltration activity, and urged organizations to report incidents, preserve artifacts, avoid ransom payments, and strengthen defenses with offline backups, MFA, patching, RDP hardening, least-privilege access, and network segmentation.
TTPs, infrastructure, and targeting history in one profile.
7 events from the most recent confirmed update back to the earliest known activity.
On March 7, 2022, the FBI, coordinated with DHS/CISA, issued FLASH CU-000163-MW with updated Ragnar Locker indicators of compromise, technical details, and mitigation guidance.
As of January 2022, the FBI had identified at least 52 entities across 10 U.S. critical infrastructure sectors affected by Ragnar Locker ransomware.
The FBI associated IP address 23.106.122.192 with updt32.exe proxy malware activity on September 27, 2021.
The FBI associated IP address 149.28.200.140 with PSCP activity tied to Ragnar Locker on September 10, 2021.
The FBI associated IP address 185.138.164.18 with access to a Confluence server during a period in September 2021.
The FBI said it first became aware of the Ragnar Locker ransomware threat in April 2020.
Ragnar Locker ransomware payloads were first observed being used in attacks in late December 2019, marking the earliest activity referenced in the sources.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**LockerGoga** hit large organizations across the United States and Europe, including reported victims such as Norsk Hydro, Altran, Hexion, and MPM Holdings, while the FBI later warned that the threat overlapped with **MegaCortex** in targeting enterprise networks. Investigators said the operators typically gained initial access through exploits, phishing, SQL injection, and stolen credentials, then spent weeks or months moving laterally with tools such as **Cobalt Strike** before encrypting systems. The malware appended the `.LOCKED` extension, dropped ransom notes such as `README_LOCKED.txt`, and in some cases was signed with a revoked **Sectigo** certificate issued to **ALISA LTD**, likely to reduce detection. Researchers said LockerGoga blurred the line between ransomware and a wiper because later variants forcibly logged users off Windows systems, blocked them from logging back in, disabled network interfaces, changed local passwords, and could even clear Windows Event Logs and encrypt files in the Recycle Bin. Reporting indicated the malware did not appear to self-propagate, but once attackers had domain access they could disable security tools and deploy it broadly across compromised environments. The FBI urged organizations to maintain offline backups, patch exposed systems, enforce strong passwords and **MFA**, disable `SMBv1`, audit remote access and account creation, monitor **Active Directory** changes, and enable **PowerShell** logging to detect similar intrusions earlier.
Aug 15, 2026
Maze and Ragnar Locker were reported using increasingly sophisticated **double-extortion** tactics that combined data theft, public leak threats, and defense evasion during ransomware intrusions. Maze operators were linked to incidents including the attack on **Cognizant** and the publication of **2GB** of allegedly stolen files from the **City of Pensacola**, underscoring that victims faced both operational disruption and potential data-breach exposure. Reporting also tied Maze to intrusion activity using exposed **RDP**, signed **Cobalt Strike** payloads, **ngrok** tunneling, remote execution with `mshta`, and tailored persistence mechanisms, with one investigated intrusion stopped before encryption was launched. A key technical shift was the adoption of **virtual-machine-based encryption** to bypass endpoint defenses. In a Sophos-investigated case, Maze failed twice after security software blocked ransomware launched through scheduled tasks, then succeeded in deploying an **MSI** package that installed **VirtualBox** and a customized **Windows 7** VM, mounted host drives, and encrypted files from inside the guest system. That approach mirrored **Ragnar Locker**, which had already used a smaller **Windows XP** VirtualBox image to make encryption appear to come from a trusted process while continuing its broader playbook of RDP-driven access, lateral movement, shadow-copy deletion, service termination, and **Salsa20** plus **RSA-2048** encryption backed by leak-site extortion.
Aug 15, 2026
Royal ransomware emerged as a major threat after first being observed in September 2022, with intrusions linked to likely Russian-speaking cybercrime actors and possible overlap with former **Conti** members. The group has hit organizations globally, including multiple Australian victims and critical infrastructure, with a concentration of cases in the United States and Canada across healthcare, manufacturing, education, and government. Royal operators steal data before encrypting systems, then pressure victims through leak-site exposure and, in some cases, social media harassment; reported ransom demands have reached **$25 million** in bitcoin. Analysts also identified infrastructure and tooling overlaps between Royal activity, **FRwL / UAC-0118**, and earlier ex-Conti-linked operations, including shared IPs and a **Cobalt Strike** watermark associated with related campaigns. Investigations show Royal gains initial access through callback phishing, SEO poisoning, malicious downloads, phishing links sent via website contact forms, exploitation of unpatched vulnerabilities, exposed **RDP**, and compromised credentials. After entry, the actors have used **BATLOADER**, **Qakbot**, **Bokbot**, **Cobalt Strike**, **PsExec**, **PowerShell**, **AdFind**, **NetScan**, **Chisel**, **Rclone**, **PCHunter**, **PowerTool**, and **Process Hacker** to move laterally, evade defenses, exfiltrate data, and deploy ransomware on Windows as well as a Linux/**ESXi** ELF variant. Royal typically encrypts local drives and network shares, appends the `.royal` extension, deletes shadow copies, disables security services, and leaves `README.txt` ransom notes with Tor-based contact instructions. Defenders are urged to prioritize **software patching**, multifactor authentication, network segmentation, traffic filtering, application allowlisting, privileged account controls, and offline encrypted backups to reduce exposure to the exploitation and credential abuse techniques seen in Royal intrusions.
Aug 15, 2026