Ragnarlocker
Ragnar Locker was an elite ransomware group active from December 2019 to October 2023 that targeted large enterprises and critical infrastructure — including Capcom and Campari — claiming at least 168 victims before being taken down by a Europol-led international law enforcement operation in October 2023.
Victims
128
First Discovered
2020-04-01
victim
Last Discovered
2023-10-11
victim
Inactive Since
2yrs
more than
Avg Delay
10
days
Infostealer
14.3%
victims with domain
Countries
6
hit
Known Locations (4)
| Favicon | Title | Type | Available | Last Visit | Server Info | FQDN | |
|---|---|---|---|---|---|---|---|
|
No | 2026-04-28T07:21:17 |
rgleak7op734elep.onion
|
||||
|
This site has been seized | Yes | 2026-05-18T23:17:58 | nginx 1.28.3 |
rgleaktxuey67yrgspmhvtnrqtgogur35lwdrup4d3igtbm3pupc4lyd.onion
|
||
|
No | 2026-04-28T07:21:19 |
p6o7m73ujalhgkiv.onion
|
||||
|
This site has been seized | Yes | 2026-05-18T23:18:42 | nginx 1.28.3 |
ragnarnwvli32xnmwudsvhbl7klzmofxeylyhcqfc5ifx5mbybq3ekqd.onion
|
Target
Top 5 Activity Sectors
- Manufacturing 25
- Technology 14
- Agriculture and Food Production 9
- Energy 9
- Business Services 9
Top 5 Countries
-
France
3
-
United Kingdom
1
-
Belize
1
-
Italy
1
-
United States
1
Heatmap
Ransom Notes (2)
Tools Used
| Discovery | RMM Tools | Defense Evasion | Credential Theft | OffSec | Networking | LOLBAS | Exfiltration |
|---|---|---|---|---|---|---|---|
|
Advanced Port Scanner
Dsquery
PsInfo
SoftPerfect LanSearchPro
|
AnyDesk
Remote Manipulator System (RMS)
RemoteUtilities
|
VirtualBox
|
|
Cobalt Strike
|
|
PsExec
WMIC
|
|
TTPs Matrix (9)
| Initial Access | Execution | Defense Evasion | Credential Access | Discovery | Lateral Movement | Exfiltration | Command and Control | Impact |
|---|---|---|---|---|---|---|---|---|
| Valid Accounts | Command and Scripting Interpreter: PowerShell | Virtualization/Sandbox Evasion: System Checks | OS Credential Dumping | System Information Discovery | Remote Services: Remote Desktop Protocol | Exfiltration Over Web Service | Application Layer Protocol: Web Protocols | Data Encrypted for Impact |
| Exploit Public-Facing Application | Disable or Modify Tools | Network Share Discovery | Inhibit System Recovery |
YARA Rules (1)
Victims (128)
AOAL - Azienda Ospedaliera di Alessandria…
No description available
No description available
No description available
No description available
