Ransomware Group intelligence
Ragnarok
InactiveTrack Ragnarok with 3 published victims and 2 known leak locations in a single intelligence view.
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Ragnarok is tracked by Breach House as a ransomware group with 3 published victims.
The group is tracked across multiple victim records in the Breach House dataset.
2 known leak locations are currently associated with this group.
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (2)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 2 | Onion service | Down checked 28m ago | sushlnty2j7qdzy64qnvyb6ajkwg7resd3p6agc2widnawodtcedgjid.onion |
| Leak location 1 | Onion service | Down checked 28m ago | wobpitin77vdsdiswr43duntv6eqw4rvphedutpaxycjdie6gg3binad.onion |
Top Activity Sectors (1)
Typical Attacks (10)
▼MITRE ATT&CK does not currently catalogue Ragnarok, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: low. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: Ragnarok executes malicious commands via PowerShell scripts embedded in its malware.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
What they do: Ragnarok modifies registry run keys to ensure persistence after reboot.
What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: Ragnarok disables antivirus tools and security monitoring mechanisms on compromised hosts.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1070.004 File Deletion Stealth
What they do: Ragnarok deletes Volume Shadow Copies and backup files to prevent recovery.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1018 Remote System Discovery Discovery
What they do: Ragnarok discovers remote systems via network scanning to spread laterally.
What that means: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.
-
T1083 File and Directory Discovery Discovery
What they do: Ragnarok scans file and directory structures to identify files suitable for encryption.
What that means: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: Ragnarok exploits SMB/Windows Admin Shares to move between networked machines.
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1486 Data Encrypted for Impact Impact
What they do: Ragnarok encrypts victim files using its own ransomware payload to hold data hostage.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1489 Service Stop Impact
What they do: Ragnarok stops critical Windows services and processes to disrupt victim operations.
What that means: Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.
-
T1490 Inhibit System Recovery Impact
What they do: Ragnarok prevents system recovery by disabling restore processes and backups.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
Ransom Notes (2)
▼The note this group leaves on a compromised machine. Click a filename to read it.
ragnarok.html
<!DOCTYPE html><h1>#ALL YOUR FILES ARE ENCRYPTED AND STOLEN BY RAGNAROK</h1>Dear Sir<br><br>Your files are encrypted with RSA4096 and AES encryption algorithm. <br>But don't worry, you can return all your files!! follow the instructions to recover your files <br><br>Cooperate with us and get the decrypter program as soon as possible will be your best solution.<br>Only our software can decrypt all your encrypted files.<br><br>What guarantees you have?<br>We take our reputation seriously. We reject any form of deception</br>You can send one of your encrypted file from your PC and we decrypt it for free. <br>But we can decrypt only 1 file for free. File must not contain any valuable information.<br>When hiring third-party negotiators or recovery companies. listen to what they tell you. try to think.<br> Are they really interested in solving your problems or are they just thinking about their profit and ambitions?<br><br>By the way.We have stolen lots of your company and your private data which includes doc,xls,pdf,jpg,mdf,sql,pst...<br>Here we upload sample files of your company and your private data on our blog :<br>http://sushlnty2j7qdzy64qnvyb6ajkwg7resd3p6agc2widnawodtcedgjid.onion/<br>We promise that if you don't pay within a week, we will package and publish all of your company and your data on our website.<br>We also promise we can decrypt all of your data and delete all your files on internet after your payment.<br>Such leaks of information lead to losses for the company. fines and lawsuits. And don't forget that information can fall into the hands of competitors!<br>For us this is just business and to prove to you our seriousness.<br><br>Our e-mail:<br> [email protected]<br><br> Reserve e-mail:<br><br>[email protected]<br><br>Device ID:<br> [snip]
ragnarok.txt
It's not late to say happy new year right? but how didn't i bring a gift as the first time we met :) #what happend to your files? Unfortunately your files are encrypted with rsa4096 and aes encryption,you won't decrypt your files without our tool but don't worry,you can follow the instructions to decrypt your files 1.obviously you need a decrypt tool so that you can decrypt all of your files 2.contact with us for our btcoin address and send us your DEVICE ID after you decide to pay 3.i will reply a specific price e.g 1.0011 or 0.9099 after i received your mail including your DEVICE ID 4.i will send your personal decrypt tool only work on your own machine after i had check the ransom paystatus 5.you can provide a file less than 1M for us to prove that we can decrypt your files after you paid 6.it's wise to pay as soon as possible it wont make you more losses the ransome: 1 btcoin for per machine,5 bitcoins for all machines how to buy bitcoin and transfer? i think you are very good at googlesearch [email protected] [email protected] [email protected] Attention:if you wont pay the ransom in five days, all of your files will be made public on internet and will be deleted YOUR DEVICE ID:
Ransom-note text from RansomLook, licensed CC BY 4.0.
Victims (3)
Search, filter and paginate the victim timeline for Ragnarok. Showing 1–3 of 3.
| Type | Target | Discovered | Country | Business Category | Intel Link |
|---|---|---|---|---|---|
| Ransomware | FNBNWFL Data leaked id2317 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Decrypt id886 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Boggi Milano id592 View details | Other | — | ||
|
No additional victim description available. |
|||||