Search threats, CVEs… ⌘K
← Back to all threat actors

ragnarlocker

Ragnar Locker was an elite ransomware group active from December 2019 to October 2023 that targeted large enterprises and critical infrastructure — including Capcom and Campari — claiming at least 168 victims before being taken down by a Europol-led international law enforcement operation in October 2023.

How we source and review actor profiles
Motivation
ransomware
Last seen
2023-10-11
Sectors
manufacturing, technology, energy-utilities, financial-services, professional-services, agriculture-and-food-production, retail-e-commerce, transportation, other, healthcare, education, hospitality
Status
Dormant

Activity timeline

A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.

Claimed
Victim claimScotbeef Ltd. - Leaks listed by ragnarlocker

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimEicon Controle Inteligentes listed by ragnarlocker

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Last observed
Indicator4 indicators cataloged

Types: onion.

Claimed
Victim claimInternational Presence Ltd - Leaked listed by ragnarlocker

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimLearning Partnership West - Leaked listed by ragnarlocker

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimGroupe Fructa Partner - Leaked listed by ragnarlocker

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimAstre - Leaked listed by ragnarlocker

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimNetwork Pacific Real Estate - Leak listed by ragnarlocker

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimStratesys Full data leak listed by ragnarlocker

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimAnnouncement: COMECA Group going to be Leaked listed by ragnarlocker

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimAnnouncement: Skatax Accounting company going to be leaked listed by ragnarlocker

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimRetail House - Full Leak listed by ragnarlocker

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimAnnouncement: Stratesys solutions going to be leaked listed by ragnarlocker

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimAnnouncement: Stratesys solutions going to b listed by ragnarlocker

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimAnnouncement: Groupe Fructa Partner will be leaked soon listed by ragnarlocker

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimCITIZEN company LEAKED listed by ragnarlocker

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimAnnouncement: Retail House going to be LEAKED listed by ragnarlocker

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimUpdates: Israel "MYMC" listed by ragnarlocker

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimIsrael Medical Center - leaked listed by ragnarlocker

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimDOIT - Canadian IT company allowed leak of its own clients. listed by ragnarlocker

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimBatesville didn't react on appeal and allows Full Leak listed by ragnarlocker

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimBatesville Tool & Die, Inc will be leaked in 3 Days listed by ragnarlocker

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimBelize Electricity Limited - Leaked listed by ragnarlocker

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimPortugal Scotturb Data Leaked listed by ragnarlocker

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed
Claimed
Victim claimAustralian Universal Crane Leak listed by ragnarlocker

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

The interactive view includes 101 dated events with category filters and paging.

Identity and attribution

Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.

Name map

ragnarlockerCanonical Name

Loading CVEs, techniques, indicators, malware, victims, and activity...