APT / THREAT GROUP

Ragnar Locker

aliases

Intelligence Profile

Ragnar Locker is a ransomware identified in December 2019 that targetscorporate networks inBig Game Huntingtargeted attacks. This reportpresents recent elements regarding this ransomware.

Threat Analysis

Ragnar Locker is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://www.bleepingcomputer.com/news/security/ragnar-locker-ransomware-targets-msp-enterprise-support-tools/

→https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/

→https://www.cybersecurity-insiders.com/ransomware-attack-makes-cwt-pay-4-5-million-in-bitcoins-to-hackers/

→https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security

→https://www.bleepingcomputer.com/news/security/ransomware-gang-threatens-to-leak-data-if-victim-contacts-fbi-police

→https://twitter.com/malwrhunterteam/status/1475568201673105409

→https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/analysis-and-protections-for-ragnarlocker-ransomware.html

→http://reversing.fun/posts/2021/04/15/unpacking_ragnarlocker_via_emulation.html

→http://reversing.fun/reversing/2021/04/15/unpacking_ragnarlocker_via_emulation.html

→https://analyst1.com/blog/ransom-mafia-analysis-of-the-worlds-first-ransomware-cartel

Quick Facts

TypeAPT / Threat Group

Aliases2

Also Known As

Ragnar LockerRagnarLocker

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Ragnar Locker