Introduction
VIKING SPIDER is the criminal group behind the development and distribution of Ragnar Locker ransomware. While public reporting indicates the group began threatening to leak victim data in February 2020, a DLS was not observed until April 2020. The DLS is hosted on Tor, and similar to other actors, proof of data exfiltration is provided before the stolen data is fully leaked. It was also noted that On Dec. 22, 2020, a new post made to MountLocker ransomware’s Tor-hosted DLS was titled ‘Cartel News’ and included details of a victim of VIKING SPIDER’s Ragnar Locker
Activities and Tactics
Country of Origin: 🏳️ [“[Unknown]”]
Notable Campaigns
- $15 million demanded
- 1TB allegedly stolen
- 2020-04
- 2020-05
- 2020-07
- 2020-11
- 2021-01
- 2021-06
- 2021-09
- 2022-08
- 2022-09
- 2022-11
- 2023-08
- Campari hit by Ragnar Locker Ransomware
- Capcom hit by Ragnar Locker ransomware
- Computer memory maker ADATA hit by Ragnar Locker ransomware
- Customer Care Giant TTEC Hit By Ransomware
- Hackers claim to publish prominent Israeli hospital’s patient data
- Ragnar Locker Likely Behind Attack on Greek Gas Operator
- Ragnar Locker Ransomware Attack Impacts Employee Records at Dassault Falcon Jet
- Ragnar Locker Targets CWT in Ransomware Attack
- Ragnar Locker ransomware claims attack on Portugal’s flag airline
- RagnarLocker ransomware hits EDP energy giant
- Ransomware Group Turns to Facebook Ads
- Ransomware deploys virtual machines to hide itself from antivirus software
- Ransomware gang targets Belgian municipality
- Ransomware gang threatens to leak data if victim contacts FBI
- asks for €10M
- hits police instead
- https://chaslescorp.com/ragnar-locker-ransomware-attack-impacts-employee-records-at-dassault-falcon-jet/
- https://cybelangel.com/blog/ragnar-locker-targets-cwt/
- https://krebsonsecurity.com/2020/11/ransomware-group-turns-to-facebook-ads/
- https://krebsonsecurity.com/2021/09/customer-care-giant-ttec-hit-by-ransomware/
- https://therecord.media/israel-hospital-data-leaked-ragnar-locker-ransomware
- https://www.bankinfosecurity.com/ragnar-locker-likely-behind-attack-on-greek-gas-operator-a-19907
- https://www.bleepingcomputer.com/news/security/campari-hit-by-ragnar-locker-ransomware-15-million-demanded/
- https://www.bleepingcomputer.com/news/security/capcom-hit-by-ragnar-locker-ransomware-1tb-allegedly-stolen/
- https://www.bleepingcomputer.com/news/security/computer-memory-maker-adata-hit-by-ragnar-locker-ransomware/
- https://www.bleepingcomputer.com/news/security/ragnar-locker-ransomware-claims-attack-on-portugals-flag-airline/
- https://www.bleepingcomputer.com/news/security/ragnarlocker-ransomware-hits-edp-energy-giant-asks-for-10m/
- https://www.bleepingcomputer.com/news/security/ransomware-gang-targets-belgian-municipality-hits-police-instead/
- https://www.bleepingcomputer.com/news/security/ransomware-gang-threatens-to-leak-data-if-victim-contacts-fbi-police/
- https://www.zdnet.com/article/ransomware-deploys-virtual-machines-to-hide-itself-from-antivirus-software/
- police
Tactics, Techniques, and Procedures (TTPs)
Information pending cataloguing.
Notable Indicators of Compromise (IOCs)
No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.
Malware and Tools
- Ragnatela
- RagnarLocker:
Attribution and Evidence
Country of Origin: [“[Unknown]”] Additional attribution information pending cataloguing.
References
References pending cataloguing.