RagnarLocker

Profile narrative

RagnarLocker is a ransomware group that conducts cyber extortion operations against organisations across various sectors. The group’s primary method involves gaining initial network access by exploiting critical vulnerabilities in exposed systems or software. After establishing a foothold, they maintain persistence within the victim environment for extended periods, sometimes exceeding six months before detection. Once they decide to monetise the intrusion, they deploy ransomware that encrypts critical servers and file shares, disrupting normal operations. In parallel with encryption, the attackers exfiltrate sensitive data, such as proprietary documents, intellectual property, or internal communications. The stolen information is then leveraged to threaten public release, auction, or other forms of disclosure unless a ransom payment is made. A notable example of this modus operandi occurred in December 2020 when RagnarLocker compromised Dassault Falcon Jet Corp.’s networks. The intrusion began with the exploitation of a critical vulnerability that allowed the attackers to enter the aerospace manufacturer’s systems. The group remained undetected for more than six months, during which they conducted reconnaissance and prepared for the ransomware phase. When the ransomware was finally executed, it targeted critical servers and file shares, encrypting essential operational data. Simultaneously, the attackers exfiltrated development documentation for new Falcon jets, intending to use it as leverage in negotiations. They demanded contact through a secure live‑chat channel, threatening to auction or release the stolen data if their demands were not met.

Distinguishing attributes of RagnarLocker include its reliance on long dwell times to maximise the impact of subsequent ransomware deployment. The group employs a double‑extortion strategy, combining data encryption with the theft and threat of leakage of confidential information. In its communications with victims, RagnarLocker often emphasises the perceived robustness of the compromised security perimeter, portraying the breach as evidence of its own capability. Negotiations are conducted exclusively via a private, encrypted chat platform that the attackers control, limiting external oversight of the demands. The group’s headquarters is reported to be located in Russia, according to available open‑source references. No explicit information regarding the organisation’s size, workforce, revenue, or hierarchical structure is publicly disclosed. Consequently, details about ownership, parent‑company relationships, or subsidiary entities are not available in the source material. The lack of structural transparency is typical for many ransomware groups that operate under pseudonyms and decentralised affiliations. As a result, assessments of RagnarLocker’s scale or market reach must rely solely on observed tactics rather than on organisational metrics. The available evidence therefore centers on the group’s technical behaviours, such as vulnerability exploitation, persistence, and data exfiltration, rather than on formal business attributes.

Incidents

1 incident linked to this organisation.