Diavol

Malware & Tools · Diavol

· MalwareS0659 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

Diavol is a ransomware variant first observed in June 2021 that is capable of prioritizing file types to encrypt based on a pre-configured list of extensions defined by the attacker. The Diavol Ransomware-as-a Service (RaaS) program is managed by Wizard Spider and it has been observed being deployed by Bazar.(Citation: Fortinet Diavol July 2021)(Citation: FBI Flash Diavol January 2022)(Citation: DFIR Diavol Ransomware December 2021)(Citation: Microsoft Ransomware as a Service)

Tactic Coverage

discovery (7)impact (5)stealth (2)command and control (2)lateral movement (1)execution (1)defense impairment (1)

Used By (1 groups)

G0102Wizard SpiderUNC1878, TEMP.MixMaster

Techniques (19)

T1016System Network Configuration Discovery

discovery

T1018Remote System Discovery

discovery

T1021.002SMB/Windows Admin Shares

lateral movement

T1027Obfuscated Files or Information

stealth

T1027.003Steganography

stealth

T1033System Owner/User Discovery

discovery

T1057Process Discovery

References

https://attack.mitre.org/software/S0659 https://thedfirreport.com/2021/12/13/diavol-ransomware/https://www.ic3.gov/CSA/2022/220120.pdf https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/https://www.fortinet.com/blog/threat-research/diavol-new-ransomware-used-by-wizard-spider