RagnarLocker

Family profile

RagnarLocker is a Windows ransomware family and associated criminal operation active since 2020, principally targeting large enterprises and critical-infrastructure organizations, including manufacturing, energy, financial services, government, information technology, and healthcare. It encrypts victim data and employs double extortion by stealing data and threatening public disclosure; operators have also been associated with DDoS-based pressure tactics. The operation has been commonly associated with Viking Spider, while affiliates linked to UNC2447 have also deployed RagnarLocker.

RagnarLocker uses layered packing and obfuscation, including VMProtect and UPX, and performs locale checks that cause execution to stop on systems configured for several CIS-region locales. Before encryption, it collects host-identification information, enumerates storage volumes and services, terminates backup and remote-management services, and deletes Volume Shadow Copies. It selectively excludes system-related directories and executable or system-file types to preserve host operability. File encryption uses symmetric encryption with RSA-2048 protection of encryption material, and encrypted files receive a victim-specific extension and marker.

A notable evasion technique is execution from an attacker-deployed Oracle VirtualBox virtual machine, including a custom Windows XP guest. The virtual machine accesses host files through shared folders, allowing encryption activity to occur from the guest environment and reducing visibility to host-based security products. RagnarLocker incidents have also involved compromise of exposed remote-access infrastructure, including unpatched VPN appliances, followed by enterprise-wide post-compromise activity and ransomware deployment. International law-enforcement action disrupted RagnarLocker infrastructure and arrested suspected participants in 2023.

Capabilities

Defense Evasion
Exfiltration
Reconnaissance

Operational record

YARA rules

Ransom notes

Leak sites

2 available

Defense Evasion

VirtualBox

Discovery Enum

Advanced Port Scanner
Dsquery
PsInfo
SoftPerfect LanSearchPro

LOLBAS

PsExec
WMIC

Offsec

Cobalt Strike

RMM Tools

AnyDesk
Remote Manipulator System (RMS)
RemoteUtilities

Reported operators

Threat actors

2 named in public reporting

UNC2447

A 2021 report by Mandiant notes the group had previously deployed RagnarLocker.

VIKING SPIDER

In November 2020, the company announced it was hit by a crippling ransomware attack. The attack was orchestrated by the RagnarLocker group.

MITRE ATT&CK

RagnarLocker in ATT&CK

39 distinct techniques

Techniques

39 techniques

T1564.006 Run Virtual Instance T1486 Data Encrypted for Impact T1497 Virtualization/Sandbox Evasion T1489 Service Stop T1005 Data from Local System T1027.002 Software Packing T1071 Application Layer Protocol T1499 Endpoint Denial of Service T1497.001 System Checks T1070.004 File Deletion T1133 External Remote Services T1490 Inhibit System Recovery T1498 Network Denial of Service T1614.001 System Language Discovery T1082 System Information Discovery T1203 Exploitation for Client Execution T1567 Exfiltration Over Web Service T1070 Indicator Removal T1566 Phishing T1041 Exfiltration Over C2 Channel T1189 Drive-by Compromise T1129 Shared Modules T1120 Peripheral Device Discovery T1027 Obfuscated Files or Information T1657 Financial Theft T1190 Exploit Public-Facing Application T1537 Transfer Data to Cloud Account T1012 Query Registry T1033 System Owner/User Discovery T1543 Create or Modify System Process T1083 File and Directory Discovery T1007 System Service Discovery T1078 Valid Accounts T1059.001 Command and Scripting Interpreter: PowerShell T1562.001 Disable or Modify Tools T1003 OS Credential Dumping T1135 Network Share Discovery T1021.001 Remote Services: Remote Desktop Protocol T1071.001 Application Layer Protocol: Web Protocols

Reporting

Research mentioning RagnarLocker

Jul 17

Sentinelone Labs

Maze Ransomware Update: Extorting and Exposing Victims - SentinelLabs

Maze emerged as one of the most influential ransomware operations targeting businesses, corporations, and municipal organizations, combining file encryption with data theft and public leak threats to force victims into paying. The group first spread through exploit kits and malicious spam, then shifted to more targeted intrusions using spear-phishing, exploitation of internet-facing services such as Citrix ADC/NetScaler and Pulse Secure VPN, and attacks against weak RDP credentials. Researchers described Maze as a C/C++ Windows PE malware with obfuscation, anti-analysis features, and a layered encryption scheme that paired ChaCha with RSA-2048. The operation also expanded its influence by forming a ransomware cartel with LockBit and RagnarLocker, sharing leak infrastructure and tradecraft in a model that helped normalize double-extortion tactics across the broader ransomware ecosystem.

May 13

Securelist