Ragnar Locker
MITRE ATT&CK: S0481 View on attack.mitre.org
Aliases: RagnarLocker, Ragnar Locker
- First seen
- 2019-12-01 00:00:00
- Malware type
- ransomware
- Family
- Malware family
- Operating systems
- windows
- Related IoCs
- 12 (12 malicious)
- Last IoC activity
- 2026-10-06 16:48:06
- Profile updated
- 2026-07-07 15:43:32
Targeted industries: energy-and-utilities government-and-public-sector manufacturing transportation-and-logistics
Targeted regions: country_code:us country_code:gb country_code:fr country_code:de
Context
Ragnar Locker is a ransomware that has been in use since at least December 2019.
Recent IoC activity
12 malicious indicators in Maltiverse are attributed to Ragnar Locker (S0481). The 12 most recently updated:
| Type | Indicator | Updated | Sources |
|---|---|---|---|
| hostname | mykgoj7uvqtgl367.onion | 2026-10-06 | 1 |
| IP address | 121.148.236.5 | 2026-09-17 | 6 |
| file sample | bf4fb693e09c987a63a32ea809b2e928a0f0761339cadcb53ed909e7692e3242 | 2026-08-12 | 1 |
| file sample | f668f74d8808f5658153ff3e6aee8653b6324ada70a4aa2034dfa20d96875836 | 2026-07-06 | 1 |
| file sample | 1602d04000a8c7221ed0d97d79f3157303e209d4640d31b8566dd52c2b09d033 | 2026-04-30 | 2 |
| file sample | e_win.exe | 2026-04-13 | 1 |
| file sample | ragnar_locker_Omniga.de_ | 2025-10-31 | 1 |
| file sample | sasas.bin | 2025-10-30 | 3 |
| file sample | ragnar_locker_GST_AutoLeather | 2025-10-24 | 1 |
| file sample | ragnar_locker | 2025-08-31 | 2 |
| URL | http://121.148.236.5/log | 2025-02-12 | 1 |
| URL | http://mykgoj7uvqtgl367.onion/log | 2025-02-12 | 1 |
Detection coverage
- 3 YARA rules
- 368 Sigma rules
Malware & tools used
- Data Encrypted for Impact (attack-pattern)
- Inhibit System Recovery (attack-pattern)
- Disable or Modify Tools (attack-pattern)
- Service Execution (attack-pattern)
- Windows Command Shell (attack-pattern)
- Run Virtual Instance (attack-pattern)
- Service Stop (attack-pattern)
- System Location Discovery (attack-pattern)
- Regsvr32 (attack-pattern)
- Windows Service (attack-pattern)
- Msiexec (attack-pattern)
- Rundll32 (attack-pattern)
- Peripheral Device Discovery (attack-pattern)
Used by threat actors
- FIN8 (threat-actor)
Detection rules
- TRELLIX_ARC_Netwalker (yara-rule)
- MALPEDIA_Win_Ragnarlocker_Auto (yara-rule)
- SIGNATURE_BASE_MAL_Ransom_Ragnarlocker_July_2020_1 (yara-rule)
Related threat objects
- Maze (malware)
Reports & references
- CrowdStrike — Double Trouble Ransomware Data Leak Extortion Part 1 (report)
- blog.reversing.xyz — Unpacking Ragnarlocker Via Emulation (report)
- blog.reversing.xyz — Unpacking Ragnarlocker Via Emulation (report)
- cyware.com — Ragnar Locker Breached 52 Organizations And Counting Fbi Warns 0588D220 (report)
- id-ransomware.blogspot.com — Ragnarlocker Ransomware (report)
- krebsonsecurity.com — Ransomware Group Turns To Facebook Ads (report)
- news.sophos.com — Mtr Casebook Uncovering A Backdoor Implant In A Solarwinds Orion Server (report)
- seguranca-informatica.pt — Ragnar Locker Malware Analysis (report)
- twitter.com — 1403707430765273095 (report)
- acronis.com — Ragnar Locker (report)
- bleepingcomputer.com — Capcom Hit By Ragnar Locker Ransomware 1Tb Allegedly Stolen (report)
- bleepingcomputer.com — Fbi Ransomware Gang Breached 52 Us Critical Infrastructure Orgs (report)
- bleepingcomputer.com — Japanese Game Dev Capcom Hit By Cyberattack Business Impacted (report)
- bleepingcomputer.com — Ragnarlocker Ransomware Hits Edp Energy Giant Asks For 10M (report)
- capcom.co.jp — E210413 (report)
- ic3.gov — 220307 (report)
- McAfee — Ragnarlocker Ransomware Threatens To Release Confidential Information (report)
- theregister.com — Fbi Says Ragnar Locker Ransomware (report)
- waterisac.org — Flash Mu 000140 Mw (report)
- zdnet.com — Capcom Quietly Discloses Cyberattack Impacting Email File Servers (report)
- ransomlook.io — Ragnarlocker (report)
- bleepingcomputer.com — Ragnar Locker Ransomware Targets Msp Enterprise Support Tools (report)
- news.sophos.com — Ragnar Locker Ransomware Deploys Virtual Machine To Dodge Security (report)
- cybersecurity-insiders.com — Ransomware Attack Makes Cwt Pay 4 5 Million In Bitcoins To Hackers (report)
- bleepingcomputer.com — Ransomware Gang Threatens To Leak Data If Victim Contacts Fbi Police (report)