Ragnar Locker
Software · ATTACK:enterprise:S0481
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0481",
"title": "Ragnar Locker",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0481",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--54895630-efd2-4608-9c24-319de972a9eb",
"external_id": "S0481",
"domain": "enterprise",
"created": "2020-06-29T23:30:53.824Z",
"modified": "2025-04-16T20:38:08.233Z",
"version": "1.2",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Cynet Ragnar Apr 2020",
"url": "https://www.cynet.com/blog/cynet-detection-report-ragnar-locker-ransomware/"
},
{
"source_name": "Sophos Ragnar May 2020",
"url": "https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/"
}
]
}Explicit source assertions (14)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0481 → uses → ATTACK:enterprise:T1486
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--05951058-e8d4-4ace-a6b8-54735c6a4769
Sophos Ragnar May 2020 · Cynet Ragnar Apr 2020ATTACK:enterprise:S0481 → uses → ATTACK:enterprise:T1490
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--06dd311f-393f-4c24-beee-19d690ae4ba2
Sophos Ragnar May 2020ATTACK:enterprise:S0481 → uses → ATTACK:enterprise:T1685
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0fef4426-7e24-4ea7-81cf-6b1454f17120
Sophos Ragnar May 2020ATTACK:enterprise:S0481 → uses → ATTACK:enterprise:T1569.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--347de212-26bf-4ad4-963f-c4dfa3c821d1
Sophos Ragnar May 2020ATTACK:enterprise:S0481 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3a20bdab-0c73-49be-a8b5-630787814773
Sophos Ragnar May 2020ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:S0481
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--692e5a04-1f20-4597-8f64-15749c9b90e9
Symantec FIN8 Jul 2023ATTACK:enterprise:S0481 → uses → ATTACK:enterprise:T1564.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--913c67d5-0c5b-40d5-be88-6ce4e5030603
Sophos Ragnar May 2020ATTACK:enterprise:S0481 → uses → ATTACK:enterprise:T1489
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9212f940-021e-49b1-b500-fa1dd76b7132
Sophos Ragnar May 2020ATTACK:enterprise:S0481 → uses → ATTACK:enterprise:T1614
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--93fdbd36-b577-44bd-b4db-6daadbef9cb2
FBI Ragnar Locker 2020ATTACK:enterprise:S0481 → uses → ATTACK:enterprise:T1218.010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--af1edc78-f0b2-450c-b91f-fe1646589173
Sophos Ragnar May 2020ATTACK:enterprise:S0481 → uses → ATTACK:enterprise:T1543.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b7573d56-3acb-464f-b63b-3734af37ad42
Sophos Ragnar May 2020ATTACK:enterprise:S0481 → uses → ATTACK:enterprise:T1218.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bf5b23c2-9b65-4909-ae6c-21b8ccadd930
Sophos Ragnar May 2020ATTACK:enterprise:S0481 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e22af0ee-ab7a-4989-9077-fe538a3ad03d
Sophos Ragnar May 2020ATTACK:enterprise:S0481 → uses → ATTACK:enterprise:T1120
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ea79bf34-c1ba-4523-879f-441d6a4a9e5e
Sophos Ragnar May 2020