Ragnar Locker was an elite ransomware group active from December 2019 to October 2023 that targeted large enterprises and critical infrastructure — including Capcom and Campari — claiming at least 168 victims before being taken down by a Europol-led international law enforcement operation in October 2023.
Runs inside a lightweight VM to evade detection
Deletes shadow copies
Checks system language and virtualization
Terminates managed services and processes