Ragnarlocker

Inactive

Ragnar Locker was an elite ransomware group active from December 2019 to October 2023 that targeted large enterprises and critical infrastructure — including Capcom and Campari — claiming at least 168 victims before being taken down by a Europol-led international law enforcement operation in October 2023.

128 Victims

Mar 31, 2020 First Discovered

Oct 11, 2023 Last Discovered

1116 Days Inactive

0% Infostealer

0/4 Sites Online

Known Locations (4)

rgleak7op734elep.onion

p6o7m73ujalhgkiv.onion

This site has been seized

rgleaktxuey67yrgspmhvtnrqtgogur35lwdrup4d3igtbm3pupc4lyd.onion

This site has been seized

ragnarnwvli32xnmwudsvhbl7klzmofxeylyhcqfc5ifx5mbybq3ekqd.onion

Tools Used

DefenseEvasion

VirtualBox

DiscoveryEnum

Advanced Port Scanner, Dsquery, PsInfo, SoftPerfect LanSearchPro

LOLBAS

PsExec, WMIC

Offsec

Cobalt Strike

RMM-Tools

AnyDesk, Remote Manipulator System (RMS), RemoteUtilities

Intelligence

📄 2 Ransom Notes
View the actual ransom notes used by this group →

Victims (128)

Detailed victim list temporarily unavailable

This group has 128 victims. The victim list API is currently responding slowly for this dataset. Country, sector, and infostealer breakdowns are not available at this time. Basic stats (victim count, first/last seen) are shown above from a faster data source.