Ragnar Locker — Ransomware Profile
Ragnar Locker was a closed extortion crew that ran its namesake ransomware from December 2019 until October 2023, favoring double extortion against large enterprises; CrowdStrike, which tracks the operators as Viking Spider, found no indication the malware was ever rented out as a service. Per FBI FLASH CU-000163-MW, the group had hit at least 52 organizations spanning 10 critical-infrastructure sectors by January 2022, and its payload shut itself down on machines with former-Soviet locale settings — a trait consistent with a Russian-speaking operation, though neither governments nor vendors ever made a firm country attribution. Reported victims included Greece's national natural-gas operator and Portugal's largest airline, according to The Record. In October 2023, an eleven-country action coordinated by Europol and Eurojust seized nine servers and the group's Tor leak site, and a suspected developer arrested in Paris was brought before the examining magistrates of the Paris Judicial Court; investigators linked the crew to 168 corporate victims since 2020. The group has not been publicly reported active since the takedown.Also tracked as
RagnarLocker, Viking Spider