FIN7, FIN8, and Other Groups Exploit Ragnar Loader for Continuous Access and Ransomware Activities

Researchers specializing in threat analysis have uncovered a “complex and constantly adapting malicious software suite” known as Ragnar Loader, which is employed by multiple cybercriminal factions and ransomware collectives such as Ragnar Locker (also known as Monstrous Mantis), FIN7, FIN8, and Ruthless Mantis (previously identified as REvil). “Ragnar Loader serves as a critical component in maintaining connections to compromised systems, aiding attackers in persisting within networks for extended operational durations,” Swiss experts revealed.