H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Ragnar Locker](https://attack.mitre.org/software/S0481) is a ransomware that has been in use since at least December 2019.(Citation: Sophos Ragnar May 2020)(Citation: Cynet Ragnar Apr 2020)

Labels

malware

14 recorded

Relationships

uses

from FIN8

Group

uses

to Data Encrypted for Impact

Technique

uses

to Disable or Modify Tools

Technique

uses

to Inhibit System Recovery

Technique

uses

to Msiexec

Technique

uses

to Peripheral Device Discovery

Technique

uses

to Regsvr32

Technique

uses

to Rundll32

Technique

uses

to Run Virtual Instance

Technique

uses

to Service Execution

Technique

uses

to Service Stop

Technique

uses

to System Location Discovery

Technique

uses

to Windows Command Shell

Technique

uses

to Windows Service

Technique

3 external

References

mitre-attack

S0481

open

Cynet Ragnar Apr 2020

https://www.cynet.com/blog/cynet-detection-report-ragnar-locker-ransomware/

open

Sophos Ragnar May 2020

https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/

open