Close Menu

RAGNARLOCKER · Threat actor profile

// THREAT ACTOR

RAGNARLOCKER_

Active

RAGNARLOCKER is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem — file encryption combined with the threat of stolen-data publication on a public leak site — and continues to post fresh victim claims as part of an ongoing extortion campaign.

For Ransomnews editorial coverage of RAGNARLOCKER — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.

123 Victims tracked
2 / 10 Active mirrors
2020-06-10 First listing
2023-10-12 Most recent

Victims by year

  • 2023 31
  • 2022 42
  • 2021 19
  • 2020 31

Leak site mirrors

10 mirrors tracked, 2 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.

  • rgleak7op734elep.onion snapshot · 2021-09-08 00:04
  • rgleaktxuey67yrgspmhvtnrqtgogur35lwdrup4d3igtbm3pupc4lyd.onion This site has been seized snapshot · 2026-08-06 21:15
  • p6o7m73ujalhgkiv.onion snapshot · 2021-09-08 00:04
  • 2dxxyil6kur3qpht2tkklupdgacrcbfun6qf5jmk3hafmt6n6ockbzid.onion snapshot · 2024-12-10 16:08
  • goh2zbohdiblk23scvtae7delci5cioy73la2lnrduxutxksl7xiscqd.onion snapshot · 2024-12-10 16:08
  • t2w5byhtkqkaw6m543i6ax3mamfdy7jkkqsduzzfwhfcep4shqqsd5id.onion snapshot · 2024-12-10 16:08
  • wxbpssv4hiwlcgt4cxam3cznu4feqgf5pqfibbku3x6dwvtcakdkyeid.onion snapshot · 2024-12-10 16:09
  • xxbsnxdqmthgpydddmuvg7yzy6pdfnlnlepxa5my4mjiqjsee6yidhyd.onion snapshot · 2024-12-10 16:09
  • 7twfgaqyik3xfuu4.onion snapshot · 2024-12-10 16:09
  • ragnarmj3hlykxstyanwtgf33eyacccleg45ctygkuw7dkgysict6xyd.onion This site has been seized snapshot · 2026-08-06 21:15

Recent victims

The 50 most recent victims claimed by RAGNARLOCKER. Total in the index: 123.

Date listed Victim Description
2023-10-12 Scotbeef Ltd. - Leaks
2023-10-11 Eicon Controle Inteligentes
2023-10-06 International Presence Ltd - Leaked
2023-10-05 Learning Partnership West - Leaked
2023-10-03 Groupe Fructa Partner - Leaked
2023-09-30 Network Pacific Real Estate - Leak
2023-09-30 Astre - Leaked
2023-09-25 Stratesys Full data leak
2023-09-22 Announcement: COMECA Group going to be Leaked
2023-09-22 Announcement: Skatax Accounting company going to be leaked
2023-09-22 Retail House - Full Leak
2023-09-21 Announcement: Stratesys solutions going to be leaked
2023-09-21 Announcement: Stratesys solutions going to b
2023-09-19 Announcement: Groupe Fructa Partner will be leaked soon
2023-09-19 CITIZEN company LEAKED
2023-09-17 Announcement: Retail House going to be LEAKED
2023-09-15 Updates: Israel "MYMC"
2023-09-06 Israel Medical Center - leaked
2023-09-02 DOIT - Canadian IT company allowed leak of its own clients.
2023-08-08 Batesville didn't react on appeal and allows Full Leak
2023-07-31 Announcement: Batesville Tool & Die, Inc will be leaked in 3 Days
2023-07-10 Belize Electricity Limited - Leaked
2023-07-05 Portugal Scotturb Data Leaked
2023-05-28 Australian Universal Crane Leak
2023-05-18 Autlan Metallorum, Mexican Miner Leak
2023-04-25 CANTALK, Canadian translation services - Leak
2023-03-29 Public Appeal to the CANTALK management
2023-03-29 Temporary Leak Page #0013995NTa
2023-03-03 New Leak in lawyers company AASP.
2023-03-03 New Leak in lawyers company.
2023-02-22 AASP claim there was no data leakage!
2022-12-28 Hundred thousands of personal data, leak preview
2022-12-21 Wrapex Industrial - Leaked
2022-12-20 Serena Hotels - Leaked
2022-12-13 ITONCLOUD - LEAKED
2022-11-25 Essent company - Leaked
2022-11-22 Leak Announcement - IT company ITonCLOUD
2022-11-16 Belgium company Zwijndrecht - Leaked
2022-10-27 DURAVIT A.G. - Announcement before publishing data
2022-10-19 DIPF-INTERN - Leaked
2022-10-19 Dollmar SpA - Leaked
2022-10-13 Fashion company ZIGI NY - Leaked
2022-10-11 DMCI Holding Leaked
2022-10-10 TANG CAPITAL LEAKED
2022-10-06 Avalon luxury transport company - Leaked
2022-10-04 AudioQuest Data Leaked
2022-10-04 Malayan Flour Mills Bhd. Data Leak
2022-09-19 TAP Air Leak of more than 1.5 million of customers and many other.
2022-09-14 DDoS instead of the Discuss - Nice try TAP Air
2022-09-14 TAP AIR PORTUGAL - 115k personal data leak

← Back to Ransomtracker

Statistics on this page are computed by Ransomnews from a live leak-site monitoring feed. Numbers update every ten minutes. Operator-written victim descriptions are truncated and shown in snippet form only. Source data: RansomLook (CC BY 4.0), aggregated and adapted by Ransomnews.