FIN7, FIN8, and Others Use Ragnar Loader for Persistent Access and Ransomware Operations

Mar 07, 2025Ravie Lakshmanan

Threat hunters have unveiled insights into a sophisticated malware toolkit known as Ragnar Loader. This toolkit is utilized by various cybercrime and ransomware groups such as Ragnar Locker, FIN7, FIN8, and Ruthless Mantis.

Ragnar Loader plays a crucial role in maintaining access to compromised systems, enabling attackers to remain undetected in networks for extended periods. According to Swiss cybersecurity company PRODAFT, the developers of Ragnar Loader continuously add new features, enhancing its modularity and evasiveness.

Initially documented by Bitdefender in August 2021, Ragnar Loader has been in use since 2020, with FIN8 deploying an updated version to distribute the BlackCat ransomware in July 2023.

Ragnar Loader’s primary function is to establish persistent control within targeted environments while employing various techniques to avoid detection and ensure operational continuity.

It utilizes PowerShell-based payloads for execution, strong encryption methods like RC4 and Base64 for concealment, and sophisticated process injection strategies to maintain stealthy control over compromised systems.

Ragnar Loader is provided to affiliates as an archive package containing components for reverse shell, local privilege escalation, and remote desktop access. It establishes communication with threat actors, enabling remote control through a command-and-control panel.

Utilizing anti-analysis techniques, Ragnar Loader employs PowerShell to resist detection and obfuscate control flow logic.

Additionally, Ragnar Loader conducts backdoor operations through DLL plugins and shellcode, reads and exfiltrates files, and utilizes a PowerShell-based pivoting file for lateral movement within networks.

Another key component is a Linux executable ELF file called \”bc\”, enabling remote connections and command execution on compromised systems. PRODAFT highlighted the similarities between \”bc\” and BackConnect modules in other malware families, emphasizing the sophistication and adaptability of modern ransomware ecosystems.

For more interesting articles, follow us on Twitter  and LinkedIn.