Ragnar Locker
Attribution profile
- Type
- Crime Syndicate
- Location
- Russia
- Known incidents
- 31 incidents
- Sources
- 15 sources
- First seen
- 2019-06-12
- Last seen
- 2023-04-04
- Updated
- 2026-10-13 04:53
- Aliases
- 1 alias
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
Ragnar Locker, also known as Ragnar Locker, operates from Russia. It has targeted municipalities, transportation companies, healthcare providers, law enforcement agencies, chemical distributors, aviation firms, gas operators, and technology firms across Europe, the Americas, and Asia. The group’s objective is financial gain through double extortion: it exfiltrates sensitive data before encrypting systems and threatens to publish the stolen information unless a ransom is paid. Initial access is commonly obtained via compromised Remote Desktop Protocol services using brute force or stolen credentials, and exploitation of vulnerable Citrix endpoints has also been observed. After gaining access, the actors escalate privileges using known Windows vulnerabilities such as CVE‑2017‑0213, deploy a VirtualBox virtual machine running a Windows XP image to evade detection, delete shadow copies, disable antivirus software, and use PowerShell scripts for lateral movement. Stolen data is uploaded to a leak site and threatened with public release. Notable operations include the December 2022 attack on an Italian hospital that exfiltrated approximately 1 TB of data, the November 2022 breach of a Belgian police unit that leaked extensive personnel and operational records, the August 2022 ransomware claim against TAP Air Portugal, the August 2022 attack on Greece’s national gas operator DESFA, and the April 2020 ransomware incident against Portuguese energy giant EDP where over 10 TB of data were allegedly stolen and a €10 million ransom demanded.
Incidents
Attributed incidents are available to members.
31 incidentsSources
Sources available to members: 15 sources.