ragnarok
Activity analysis
HackerFeeds has tracked 3 victims claimed by ragnarok since March 2021, most recently in December 2021 — ranking #285 of 332 groups (0% of all tracked ransomware victims). No new victims have been posted in the last 180 days; the most recent claim was in December 2021. Its most-targeted sector is Technology (1 victims), followed by Financial Services (1).
Victims per year
- 20213
Top sectors
- Technology1
- Financial Services1
- Consumer Services1
Top countries
Computed from victims claimed on the group's leak site as collected by HackerFeeds; claims are not independently verified. Monthly reports · Methodology
Group profile
According to Bleeping Computer, the ransomware is used in targeted attacks against unpatched Citrix servers. It excludes Russian and Chinese targets using the system's Language ID for filtering. It also tries to disable Windows Defender and has a number of UNIX filepath references in its strings. Encryption method is AES using a dynamically generated key, then bundling this key up via RSA.
Recent victims
| Date | Website / victim | Sector | Country |
|---|---|---|---|
| 2021-12-30 | F FNBNWFL Data leaked | Financial Services | |
| 2021-09-09 | D Decrypt | Technology | |
| 2021-03-31 | B Boggi Milano | Retail & E-Commerce |