Ragnar Locker
- ID
- S0481
- Type
- Malware
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 17 Apr 2025
Ragnar Locker is a ransomware that has been in use since at least December 2019.[1][2]
Techniques used (13)
- T1059.003 Windows Command Shell
- T1120 Peripheral Device Discovery
- T1218.007 Msiexec
- T1218.010 Regsvr32
- T1218.011 Rundll32
- T1486 Data Encrypted for Impact
- T1489 Service Stop
- T1490 Inhibit System Recovery
- T1543.003 Windows Service
- T1564.006 Run Virtual Instance
- T1569.002 Service Execution
- T1614 System Location Discovery
- T1685 Disable or Modify Tools