RagnarLocker (Windows)
- Malware type
- ransomware
- Family
- Malware family
- Profile updated
- 2026-07-07 12:47:14
Targeted industries: energy-and-utilities financial-services manufacturing professional-services retail-and-hospitality
Targeted regions: country_code:us country_code:gb country_code:fr country_code:es country_code:it
Context
RagnarLocker is a sophisticated ransomware targeting large organizations across various industries, particularly in Europe and North America. Known for its double-extortion tactics, it not only encrypts files but also threatens to release stolen information if the ransom is not paid.
Reports & references
- CrowdStrike — Double Trouble Ransomware Data Leak Extortion Part 1 (report)
- analyst1.com — Ransom Mafia Analysis Of The World%E2%80%99S First Ransomware Cartel (report)
- CrowdStrike — Report2021Gtr (report)
- analyst1.com — Ransom Mafia Analysis Of The Worlds First Ransomware Cartel (report)
- accenture.com — Moving Left Ransomware Boom (report)
- docs.google.com — 1Mi8Z2Tbhmqq5X8Wf Ozv3Dvjz5Sjos 3 (report)
- ics-cert.kaspersky.com — Kaspersky H1 2020 Ics Report En (report)
- ke-la.com — How Ransomware Gangs Find New Monetization Schemes And Evolve In Marketing (report)
- news.sophos.com — The Ransomware Threat Intelligence Center (report)
- public.intel471.com — Ransomware As A Service 2020 Ryuk Maze Revil Egregor Doppelpaymer (report)
- Broadcom/Symantec — The Ransomware Threat September 2021 (report)
- accenture.com — Evolving Danger Ransomware Extortion (report)
- cyborgsecurity.com — Hunting Ransomware Inhibiting System Backup Or Recovery (report)
- hornetsecurity.com — Leakware Ransomware Hybrid Attacks (report)
- Microsoft — Ransomware Groups Continue To Target Healthcare Critical Services Heres How To Reduce Risk (report)
- intel471.com — Conti Ransomware Cooperation Maze Lockbit Ragnar Locker (report)
- Kaspersky — 99255 (report)
- Kaspersky — 106824 (report)
- news.sophos.com — Ragnar Locker Ransomware Deploys Virtual Machine To Dodge Security (report)
- trellix.com — Analysis And Protections For Ragnarlocker Ransomware (report)
- reversing.fun — Unpacking Ragnarlocker Via Emulation (report)
- reversing.fun — Unpacking Ragnarlocker Via Emulation (report)
- blog.blazeinfosec.com — Dissecting Ragnar Locker The Case Of Edp (report)
- blog.bushidotoken.net — Gamer Cheater Hacker Spy (report)
- blog.cyble.com — Deep Dive Into Ragnar Locker Ransomware Gang (report)