ragnarlocker

RagnarLocker was a Russia-linked ransomware group active from 2019 to 2023, known for conducting its own intrusions without an affiliate structure and for a distinctive tactic of mounting ransomware inside a virtual machine (Oracle VirtualBox with a Windows XP image) to evade endpoint security products. The group was a founding member of the Maze ransomware cartel in 2020 and targeted critical infrastructure, energy companies, and large enterprises including Capcom, EDP (Portuguese energy), and Danaher. A coordinated Europol-led international law enforcement operation in October 2023 arrested its alleged main developer in Paris and seized its dark web infrastructure, ending the group's operations.