THREAT ACTOR

RAGNAROK_

Dormant

RAGNAROK is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.

For Ransomnews editorial coverage of RAGNAROK, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.

1 Victims tracked

0 / 2 Active mirrors

2021-09-09 First listing

2021-09-09 Most recent

Victims by year

2021 1

Leak site mirrors

2 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.

wobpitin77vdsdiswr43duntv6eqw4rvphedutpaxycjdie6gg3binad.onion snapshot · 2021-09-08 00:06
sushlnty2j7qdzy64qnvyb6ajkwg7resd3p6agc2widnawodtcedgjid.onion Decrypt Site snapshot · 2021-09-08 00:06

Recent victims

The 50 most recent victims claimed by RAGNAROK. Total in the index: 1.

Date listed	Victim	Description
2021-09-09	Decrypt

CONFIRMED ATTACKS

Ragnarok confirmed attacks: 11 verified incidents

Ransomnews has verified 11 Ragnarok incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from January 2021 to August 2021. Italy accounts for 6 of them (55%), with victims recorded in 3 countries in total. The most affected sector is technology, at 2 confirmed victims. A ransom payment was publicly confirmed in 0 cases and publicly refused in 1; the outcome is unrecorded in the remaining 10.

11Verified incidents

3Countries

2021–2021Active range

0%Paid, where outcome known

Confirmed victims by year

202111

Most affected sectors

Technology2
Healthcare2
Retail2
Other1
Service1
Manufacturing1
Finance1
Education1

Most affected countries

Italy6
France3
Germany2

Verified Ragnarok incidents

Date	Organisation	Sector	Location	Records	Ransom paid	Source
August 2021	AssurOne	Finance	Normandy, France	—	Unknown	Source
July 2021	Groupe Profil	Service	Lyon, France	—	Unknown	Source
April 2021	Moba Mobil Automation	Technology	Limburg, Germany	—	Unknown	Source
March 2021	Technische Universität Darmstadt	Education	Darmstadt, Germany	—	Unknown	Source
March 2021	Montagnettes	Other	Tours-en-Savoie, France	—	Unknown	Source
March 2021	Boggi Milano	Retail	Monza, Italy	—	Unknown	Source
February 2021	Laboratorio Analisi Valdès	Healthcare	Cagliari, Italy	—	No	Source
January 2021	Semantica SRL	Technology	Forli, Italy	—	Unknown	Source
January 2021	Moreschi SPA	Retail	Pavia, Italy	—	Unknown	Source
January 2021	Medicair Italia SRL	Healthcare	Vigonza, Italy	—	Unknown	Source
January 2021	Eurapo SRL	Manufacturing	Pordenone, Italy	—	Unknown	Source

Claimed vs confirmed. The figures above the fold on this page come from Ragnarok's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.

← Back to Ransomtracker

Statistics on this page are computed by Ransomnews from a live leak-site monitoring feed. Numbers update every ten minutes. Operator-written victim descriptions are truncated and shown in snippet form only. Source data: RansomLook (CC BY 4.0), aggregated and adapted by Ransomnews.