Ragnar is a ransomware family covered through reported incidents, technical analysis, disruption efforts, and defensive guidance for organizations.
Search across headline titles and summaries.
Background for this topic.
Ragnar is a ransomware family and criminal operation, not the unrelated software or product names that may use “Ragnar.” It encrypts files to disrupt access; reporting has also associated some incidents with theft of data and threats to disclose it. Coverage under this tag may include claimed or confirmed deployments, technical analysis of the malware and infrastructure, defensive guidance, and law-enforcement or other disruption activity. Incident claims and attribution require independent validation, particularly when operators or researchers publish incomplete information.
The main security concerns are loss of system availability and potential exposure of sensitive data. Organizations should maintain tested, offline or otherwise protected backups; apply security updates to internet-facing systems; enforce multifactor authentication and restrict privileged access; and monitor for unusual account, administrative, and file-encryption activity. If Ragnar is suspected, isolate affected systems without unnecessarily destroying evidence, preserve relevant logs, identify possible data access or exfiltration, and coordinate recovery with legal, privacy, and regulatory teams. Do not assume that paying a ransom will restore files or prevent disclosure.
Weekly headline count for the current query.
Threat hunters have shed light on a "sophisticated and evolving malware toolkit" called Ragnar Loader that's used by various cybercrime and ransomware groups like Ragnar Locker (aka Monstrous Mantis), FIN7, FIN8, and Ruthless Mantis (ex-REvil)
Group Fakes Stolen Data, Has Ties to Ragnar Locker, Says Researcher Jon DiMaggioWhile ransomware groups rightly have a reputation for being morally and ethically bankrupt, many do play things straight with their victims. But RansomedVC is a notable exception. In some ways, it is "more dangerous" because of its expert ability to lie, according to researcher Jon DiMaggio.
Cops track down ransomware developer and seize Ragnar Locker infrastructure and data-leak site, Europol says.
Prolific variant frequently targeted critical infrastructure
Europol on Friday announced the takedown of the infrastructure associated with Ragnar Locker ransomware, alongside the arrest of a "key target" in France
Law enforcement agencies arrested a malware developer linked with the Ragnar Locker ransomware gang and seized the group's dark web sites in a joint international operation. [...]
Law enforcement agencies arrested a malware developer linked with the Ragnar Locker ransomware gang and seized the group's dark web sites in a joint international operation. [...]
The Ragnar Locker ransomware operation's Tor negotiation and data leak sites were seized Thursday morning as part of an international law enforcement operation. [...]
Several countries in Europe as well as the United States and Japan were involved in the operation, which is aimed at defanging one of the bigger names in ransomware.
The Ragnar Locker ransomware gang has claimed responsibility for an attack on Israel's Mayanei Hayeshua hospital, threatening to leak 1 TB of data allegedly stolen during the cyberattack. [...]
The Ragnar Locker ransomware gang has published stolen data from what they thought was the municipality of Zwijndrecht, but turned out to be stolen from Zwijndrecht police, a local police unit in Antwerp, Belgium. [...]
TAP assures its customers that it stopped data theft in a recent cyberattack, but the Ragnar Locker ransomware group says it made off with user info.
The malware can also check if specific products are installed, particularly security software
The Ragnar Locker ransomware gang has claimed an attack on the flag carrier of Portugal, TAP Air Portugal, disclosed by the airline last Friday. [...]
Bureau releases indicators of compromise for the RagnarLocker ransomware that has hit 10 different critical infrastructure sectors.
Victims include energy, financial services, government, and IT bodies The Ragnar Locker ransomware gang has so far infected at least 52 critical infrastructure organizations in America across sectors including manufacturing, energy, financial services, government, and information technology, according to an FBI alert this week.…
FBI reveals concerning new details of RagnarLocker campaigns
The US Federal Bureau of Investigation (FBI) says the Ragnar Locker ransomware group has breached the networks of at least 52 organizations from multiple US critical infrastructure sectors. [...]