Loading malware…
RagnarLocker is a human-operated ransomware family active since 2020 that has primarily targeted large enterprises and critical infrastructure organizations in North America and Europe. It is associated with the RagnarLocker criminal operation and has also been linked in reporting to the Viking Spider ecosystem; affiliates connected to UNC2447 have previously deployed it. The malware is used in double-extortion campaigns that combine file encryption with theft of victim data and threats to publish stolen information, and some reporting also describes the operation using additional pressure tactics such as distributed denial-of-service attacks.
RagnarLocker is notable for its emphasis on defense evasion and operational reliability. It has used multiple packing and obfuscation methods, including commercial and custom protectors, and performs locale checks to avoid execution on systems configured for several CIS-region languages. Before encryption, it gathers host-identifying information, enumerates disks and services, assigns drive letters to mounted volumes when needed, and attempts to terminate services associated with backup, security, and remote administration products. It also deletes Volume Shadow Copies to inhibit recovery and avoids re-encrypting files that already bear its internal marker.
A distinctive tradecraft feature is execution from within an attacker-controlled Windows virtual machine deployed on the victim network, including documented use of Windows XP in Oracle VirtualBox. This technique allows the ransomware to access host files through shared resources while reducing visibility to host-based security tooling. During encryption, RagnarLocker skips selected system directories and executable or system-critical file types to preserve system operability while maximizing impact on business data. Reporting describes its cryptographic design as using symmetric file encryption protected by an embedded RSA-2048 public key, with variants described using Salsa20 for file data encryption.
Victimology includes at least dozens of affected entities across multiple critical infrastructure sectors, including manufacturing, energy, financial services, government, and information technology. Publicly reported victims include Capcom and a hospital in Israel. Law-enforcement actions in 2023 disrupted parts of the operation, including seizure of infrastructure and arrests, but RagnarLocker remains an important ransomware family in the evolution of enterprise extortion tradecraft, particularly for its early adoption of VM-based execution and leak-site pressure.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
A 2021 report by Mandiant notes the group had previously deployed RagnarLocker.
In November 2020, the company announced it was hit by a crippling ransomware attack. The attack was orchestrated by the RagnarLocker group.
Overview RagnarLocker is a Ransomware normally associated with the group Viking Spider... Finally, to execute the txt in the default session in which the RagnarLocker has worked...
31 distinct techniques documented for this family, organized by ATT&CK tactic.
Может распространяться путём взлома через незащищенную конфигурацию RDP...
Может распространяться путём... обманных загрузок... вредоносной рекламы, веб-инжектов, фальшивых обновлений...
Может распространяться путём взлома через незащищенную конфигурацию RDP...
Finally, to execute the txt in the default session in which the RagnarLocker has worked, it performs an Interactive window station in which we will see how it gets the session identifier, the process that is running the Ransomware, duplicate your token, get the session, and so on, to spawn the file in the session
Finally, to execute the txt in the default session in which the RagnarLocker has worked, it performs an Interactive window station in which we will see how it gets the session identifier, the process that is running the Ransomware, duplicate your token, get the session, and so on, to spawn the file in the session
RagnarLocker uses VMProtect, UPX, and custom packing algorithms
Удаляет теневые копии файлов командами: WMIC.exe shadowcopy delete ... vssadmin delete shadows /all /quiet
The malware then attempts to silently delete all Volume Shadow Copies, preventing user recovery of encrypted files, using two different methods: vssadmin delete shadows /all /quiet and wmic.exe.shadowcopy.delete.
RagnarLocker uses VMProtect, UPX, and custom packing algorithms and deploys within an attacker’s custom Windows XP virtual machine on a target’s site.
Ragnar Locker uses Windows API GetLocaleInfoW to identify the location of the infected machine. If the victim location is identified as 'Azerbaijani,' 'Armenian,' 'Belorussian,' 'Kazakh,' 'Kyrgyz,' 'Moldavian,' 'Tajik,' 'Russian,' 'Turkmen,' 'Uzbek,' 'Ukrainian,' or 'Georgian,' the process terminates.
After identifying disks to be encrypted, it is dedicated to enumerate services, in which, we can see that it uses the EnumServiceStatusA
as well as the MachineGUID of the computer using the Microsoft RegKey Crypthography or the ProductName using the RegKey Windows NT\Current Version
The binary gathers the unique machine GUID, operating system product name, and user name currently running the process.
After identifying disks to be encrypted... Later, it will try to encrypt the files avoiding some folders, files and extensions that it will also check in memory, avoiding touching what it does not need to encrypt
RagnarLocker identifies all attached hard drives using Windows APIs: CreateFileW, DeviceIoControl, GetLogicalDrives, and SetVolumeMountPointA.
RagnarLocker uses VMProtect, UPX, and custom packing algorithms and deploys within an attacker’s custom Windows XP virtual machine on a target’s site.
Ragnar Locker uses Windows API GetLocaleInfoW to identify the location of the infected machine. If the victim location is identified as 'Azerbaijani,' 'Armenian,' 'Belorussian,' 'Kazakh,' 'Kyrgyz,' 'Moldavian,' 'Tajik,' 'Russian,' 'Turkmen,' 'Uzbek,' 'Ukrainian,' or 'Georgian,' the process terminates.
the Egregor operators stole unencrypted files from the company and leaked a 380MB archive on its darknet leak site
The crooks steal sensitive data, encrypt a victim's systems, and threaten to leak the stolen documents if the ransom to restore the files isn't paid. To date, the Ragnar Locker criminals have posted stolen data from at least ten organizations on their publicity website.
Lastly, RagnarLocker encrypts all available files of interest. Instead of choosing which files to encrypt, RagnarLocker chooses which folders it will not encrypt.
Перед шифрованием завершает работу следующих служб, среди которых есть программы для удаленного управления: vss sql memtas mepocs sophos veeam... | в случае совпадения вредонос прекратит работу ("TerminateProcess") с кодом ошибки 0x29A.
Удаляет теневые копии файлов командами: WMIC.exe shadowcopy delete ... vssadmin delete shadows /all /quiet
Triple extortion follows a straightforward formula: adding DDoS attacks to the aforementioned encryption and data exposure threats.
41 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Other indicator types observed in public reporting.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Enterprise-focused ransomware that encrypts files, steals data before encryption for extortion, and may use DDoS pressure tactics. The content says it appends .ragnar_<ID> style extensions, drops ransom notes named RGNR_<ID>.txt, deletes shadow copies, terminates backup/remote-management services, avoids CIS locales, and in some campaigns used a VirtualBox Windows XP VM to evade host-based antivirus during encryption.
Ransomware family listed among malicious activity associated with ISPsystem-derived hostnames.
Ransomware family cited as an early adopter of triple extortion by adding DDoS attacks to encryption and data-leak threats.
Ransomware brand referenced as linked/associated to RansomHouse per reporting; no additional technical detail provided.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.