Loading malware…
RagnarLocker is a Windows ransomware family used in human-operated attacks against large businesses and critical infrastructure organizations since 2020. Its operators combine file encryption with data theft and threats to publish stolen information, and have also used DDoS attacks to increase pressure on victims. Affected sectors include manufacturing, energy, financial services, government, information technology, healthcare, and gaming. By January 2022, the FBI had identified at least 52 affected entities across 10 critical infrastructure sectors. RagnarLocker is distinct from Ragnarok ransomware.
The malware checks system locale and terminates on selected languages associated with countries in the Commonwealth of Independent States and neighboring regions. It collects host identifiers, enumerates storage volumes, and can assign drive letters to otherwise unmounted volumes before encryption. It terminates services associated with backup, security, and remote administration, deletes Volume Shadow Copies, and excludes selected system files and directories to preserve operating-system usability. It also checks for previously encrypted files to avoid repeated encryption. Detection-evasion techniques include VMProtect, UPX, custom packing, and execution inside an attacker-controlled Windows XP virtual machine using Oracle VirtualBox. Shared folders allow the virtualized ransomware to encrypt host data while obscuring its execution from host-based security tools.
RagnarLocker intrusions have involved stolen credentials, RDP, Cobalt Strike, and exploitation of vulnerable remote-access infrastructure. The family is associated with Viking Spider, and UNC2447-affiliated actors have also deployed it. In June 2020, its operators cooperated with Maze and LockBit in a ransomware cartel that shared leak infrastructure and tradecraft. An international law-enforcement operation disrupted RagnarLocker in October 2023, seizing infrastructure and its data-leak portal and arresting an alleged principal operator.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
A 2021 report by Mandiant notes the group had previously deployed RagnarLocker.
In November 2020, the company announced it was hit by a crippling ransomware attack. The attack was orchestrated by the RagnarLocker group.
32 distinct techniques documented for this family, organized by ATT&CK tactic.
Может распространяться путём взлома через незащищенную конфигурацию RDP...
Может распространяться путём... обманных загрузок... вредоносной рекламы, веб-инжектов, фальшивых обновлений...
Может распространяться путём взлома через незащищенную конфигурацию RDP...
Finally, to execute the txt in the default session in which the RagnarLocker has worked, it performs an Interactive window station in which we will see how it gets the session identifier, the process that is running the Ransomware, duplicate your token, get the session, and so on, to spawn the file in the session
Finally, to execute the txt in the default session in which the RagnarLocker has worked, it performs an Interactive window station in which we will see how it gets the session identifier, the process that is running the Ransomware, duplicate your token, get the session, and so on, to spawn the file in the session
RagnarLocker uses VMProtect, UPX, and custom packing algorithms
Удаляет теневые копии файлов командами: WMIC.exe shadowcopy delete ... vssadmin delete shadows /all /quiet
The malware then attempts to silently delete all Volume Shadow Copies, preventing user recovery of encrypted files, using two different methods: vssadmin delete shadows /all /quiet and wmic.exe.shadowcopy.delete.
“To mask active file-system activity from monitoring tools, ransomware gangs sometimes run the entire encryption process inside a virtual machine deployed on the victim’s computer.”
Ragnar Locker uses Windows API GetLocaleInfoW to identify the location of the infected machine. If the victim location is identified as 'Azerbaijani,' 'Armenian,' 'Belorussian,' 'Kazakh,' 'Kyrgyz,' 'Moldavian,' 'Tajik,' 'Russian,' 'Turkmen,' 'Uzbek,' 'Ukrainian,' or 'Georgian,' the process terminates.
«банды вымогателей иногда разворачивают весь процесс шифрования в установленной на компьютере жертвы виртуальной машине, чтобы замаскировать от мониторинга активную деятельность в файловой системе. Шифровальщик RagnarLocker применял VirtualBox, а в кампании CRON#TRAP использовалась среда QEMU».
After identifying disks to be encrypted, it is dedicated to enumerate services, in which, we can see that it uses the EnumServiceStatusA
as well as the MachineGUID of the computer using the Microsoft RegKey Crypthography or the ProductName using the RegKey Windows NT\Current Version
The binary gathers the unique machine GUID, operating system product name, and user name currently running the process.
After identifying disks to be encrypted... Later, it will try to encrypt the files avoiding some folders, files and extensions that it will also check in memory, avoiding touching what it does not need to encrypt
RagnarLocker identifies all attached hard drives using Windows APIs: CreateFileW, DeviceIoControl, GetLogicalDrives, and SetVolumeMountPointA.
“To mask active file-system activity from monitoring tools, ransomware gangs sometimes run the entire encryption process inside a virtual machine deployed on the victim’s computer.”
Ragnar Locker uses Windows API GetLocaleInfoW to identify the location of the infected machine. If the victim location is identified as 'Azerbaijani,' 'Armenian,' 'Belorussian,' 'Kazakh,' 'Kyrgyz,' 'Moldavian,' 'Tajik,' 'Russian,' 'Turkmen,' 'Uzbek,' 'Ukrainian,' or 'Georgian,' the process terminates.
the Egregor operators stole unencrypted files from the company and leaked a 380MB archive on its darknet leak site
The crooks steal sensitive data, encrypt a victim's systems, and threaten to leak the stolen documents if the ransom to restore the files isn't paid. To date, the Ragnar Locker criminals have posted stolen data from at least ten organizations on their publicity website.
“ransomware gangs sometimes run the entire encryption process inside a virtual machine” and “RagnarLocker ransomware strain has used VirtualBox for this purpose.”
Перед шифрованием завершает работу следующих служб, среди которых есть программы для удаленного управления: vss sql memtas mepocs sophos veeam... | в случае совпадения вредонос прекратит работу ("TerminateProcess") с кодом ошибки 0x29A.
Удаляет теневые копии файлов командами: WMIC.exe shadowcopy delete ... vssadmin delete shadows /all /quiet
Triple extortion follows a straightforward formula: adding DDoS attacks to the aforementioned encryption and data exposure threats.
41 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Other indicator types observed in public reporting.
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware that can use a VirtualBox virtual machine to perform file encryption, helping mask intensive filesystem activity from monitoring.
Ransomware strain cited as running its encryption process inside a VirtualBox virtual machine on a victim computer to mask file-system activity from monitoring tools.
Enterprise-focused ransomware that encrypts files, steals data before encryption for extortion, and may use DDoS pressure tactics. The content says it appends .ragnar_<ID> style extensions, drops ransom notes named RGNR_<ID>.txt, deletes shadow copies, terminates backup/remote-management services, avoids CIS locales, and in some campaigns used a VirtualBox Windows XP VM to evade host-based antivirus during encryption.
Ransomware family listed among malicious activity associated with ISPsystem-derived hostnames.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.