Ragnar Locker
ObscureIQ Threat Intelligence · Actor Profile
Ragnar LockerConfidence: High
Ransomware
Also known as: RagnarLocker
Motivation: Financial
1Attributed Breaches Circulating
HighAttribution Confidence
RansomwareActor Type
Overview
Known for deploying a full virtual machine to evade endpoint security, active from December 2019 against corporate networks with multi-extortion and a focus on the energy sector. Operations were disrupted in an October 2023 Europol-led takedown with arrests across the Czech Republic, Spain, and Latvia.
Tactics, Targeting & TTPs
Known for deploying a full virtual machine to evade endpoint security. Operations disrupted October 2023 in an international law-enforcement takedown (Europol), with arrests across Czech Republic, Spain and Latvia.
Source
Attribution draws on public threat-intelligence reporting · Established (multi-source). Primary source →
Were you exposed in one of these breaches?
Check your exposure privately, or request a tailored exposure audit.