ragnarlocker

T1078Valid Accounts

Compromised MSP accounts used to gain access to multiple downstream customer environments simultaneously.

T1190Exploit Public-Facing Application

Ragnar Locker exploited vulnerabilities in RDP, VPN appliances, and managed service provider (MSP) tooling to gain initial access.

T1059.001Command and Scripting Interpreter: PowerShell

PowerShell used for payload deployment and post-exploitation commands.

T1497.001Virtualization/Sandbox Evasion: System Checks

Ragnar Locker notably deployed its ransomware payload inside a VirtualBox Windows XP virtual machine to evade host-based security tools that could not inspect the VM's activity.

T1562.001Disable or Modify Tools

Security tools including managed service provider (MSP) remote management agents terminated to prevent remote remediation.

T1003OS Credential Dumping

Credential dumping tools used to harvest domain and local account credentials.

T1082System Information Discovery

System locale and language checked; execution terminates on CIS-region machines.

T1135Network Share Discovery

Network shares and mapped drives enumerated to maximize encryption coverage.

T1021.001Remote Services: Remote Desktop Protocol

RDP leveraged for lateral movement across victim environments.

T1567Exfiltration Over Web Service

Data exfiltrated to actor-controlled infrastructure ahead of encryption for double extortion via the Ragnar Locker leak site.

T1071.001Application Layer Protocol: Web Protocols

Cobalt Strike used for C2 over HTTPS.

T1486Data Encrypted for Impact

Ragnar Locker uses Salsa20 for file encryption with RSA-2048 for key protection. Unique technique of deploying payload inside a VirtualBox VM to bypass endpoint security. Active 2020-2023; key infrastructure seized by Europol/FBI in October 2023.

T1490Inhibit System Recovery

Volume Shadow Copies deleted; Windows recovery environment disabled.