OpenTrojan Intelligence Infrastructure
Search intelligence, CVEs, threats… Search
Ask AI Analyst API
English中文
Enter Portal

RagnarLocker Ransomware

malware OpenTrojan Threat Intelligence

Targeted VM/lower-stealth ransomware

Source Attribution

Origin
MITRE
Source
FBI/CISA advisory AA22-???
Verified
2026-08-26T16:07:01.550Z
Confidence
high

Source: FBI/CISA advisory AA22-??? · Verified: 2026-08-26T16:07:01.550Z · Confidence: high

Security Timeline

  • discovered RagnarLocker Ransomware first observed
  • updated Encyclopedia entry reviewed (Phase 45C)

Quick Answer

RagnarLocker is a human-operated ransomware with VM detection and double extortion; disrupted in 2023. (attributes recorded from FBI/CISA advisory AA22-???).

Definition

RagnarLocker is a human-operated ransomware with VM detection and double extortion; disrupted in 2023.

Overview

RagnarLocker is a human-operated ransomware with VM detection and double extortion; disrupted in 2023.

Behavior

  • VM-aware
  • human-operated
  • leak site

First Seen

2019-12

Target

Targeted VM/lower-stealth ransomware

Malware Intelligence

Family: RagnarLocker Ransomware

Techniques: T1486, T1497

Targets: Targeted VM/lower-stealth ransomware

Behavior:
  • VM-aware
  • human-operated
  • leak site

Related

References

Have a follow-up question?

Ask OpenTrojan's evidence-backed assistant about this topic — answers cite their sources.

Ask AI about this Start an investigation

Start Investigation

Move from reading to investigating RagnarLocker Ransomware. The workspace is a structured analysis surface — not a chat — organised as:

  1. Question — what do you need to know about RagnarLocker Ransomware?
  2. Evidence — assertions mapped to verifiable references.
  3. Timeline — events in chronological order.
  4. Related Entities — CVE, threat actor, campaign, malware links.
  5. Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.
  6. Notes — your own observations and working hypotheses.

AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.

Start Investigation Open Workspace

Recommended Tools

Every tool runs passively or locally — inputs are never stored and no target is scanned.Start an investigation on this entity →