ragnarlocker Ransomware
Monitorado desde 01/04/2020
0
vítimas registradas
0
nos últimos 30 dias
0
CVEs
—
Última atividade
No MITRE ATT&CK MITRE ATT&CK
Ransomware catalogado como Ragnar Locker (S0481)
Usado por: FIN8 G0061
Ragnar Locker was an elite ransomware group active from December 2019 to October 2023 that targeted large enterprises and critical infrastructure — including Capcom and Campari — claiming at least 168 victims before being taken down by a Europol-led international law enforcement operation in October 2023.
Vulnerabilidades citadas para este grupo
CVEs associadas ao grupo pelo ransomware.live. Fichas ainda não publicadas aparecem sem link.
Nenhuma CVE associada a este grupo nas fontes.
Táticas e técnicas (MITRE ATT&CK)
Initial Access
T1078 Valid AccountsT1190 Exploit Public-Facing Application Execution
T1059.001 Command and Scripting Interpreter: PowerShell Defense Evasion
T1497.001 Virtualization/Sandbox Evasion: System ChecksT1562.001 Disable or Modify Tools Credential Access
T1003 OS Credential Dumping Discovery
T1082 System Information DiscoveryT1135 Network Share Discovery Lateral Movement
T1021.001 Remote Services: Remote Desktop Protocol Exfiltration
T1567 Exfiltration Over Web Service Command and Control
T1071.001 Application Layer Protocol: Web Protocols Impact
T1486 Data Encrypted for ImpactT1490 Inhibit System Recovery Ferramentas observadas
Defense Evasion
VirtualBox
Discovery Enum
Advanced Port Scanner · Dsquery · PsInfo · SoftPerfect LanSearchPro
LOLBAS
PsExec · WMIC
Offsec
Cobalt Strike
RMM-Tools
AnyDesk · Remote Manipulator System (RMS) · RemoteUtilities
Vítimas divulgadas em sites de vazamento, segundo o ransomware.live. Não exibimos nomes de vítimas. · Ver no ransomware.live