MITRE ATT&CKsoftware (malware)
S0659 Diavol
- Domain
- enterprise
- Platforms
- Windows
- Version
- 2.0
- Created
- 2021-11-12
Description
Diavol is a ransomware variant first observed in June 2021 that is capable of prioritizing file types to encrypt based on a pre-configured list of extensions defined by the attacker. The Diavol Ransomware-as-a Service (RaaS) program is managed by Wizard Spider and it has been observed being deployed by Bazar.
Related
Uses · MITRE ATT&CK (19)
- T1685 Disable or Modify Tools technique
- T1071.001 Web Protocols sub-technique
- T1491.001 Internal Defacement sub-technique
- T1021.002 SMB/Windows Admin Shares sub-technique
- T1027.003 Steganography sub-technique
- T1490 Inhibit System Recovery technique
- T1489 Service Stop technique
- T1486 Data Encrypted for Impact technique
- T1485 Data Destruction technique
- T1135 Network Share Discovery technique
- T1016 System Network Configuration Discovery technique
- T1018 Remote System Discovery technique
- T1027 Obfuscated Files or Information technique
- T1033 System Owner/User Discovery technique
- T1057 Process Discovery technique
- T1082 System Information Discovery technique
- T1083 File and Directory Discovery technique
- T1105 Ingress Tool Transfer technique
- T1106 Native API technique
Referenced by MITRE ATT&CK · uses (1)
- G0102 Wizard Spider group
References
- https://thedfirreport.com/2021/12/13/diavol-ransomware/ DFIR Diavol Ransomware December 2021
- https://www.ic3.gov/CSA/2022/220120.pdf FBI Flash Diavol January 2022
- https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/ Microsoft Ransomware as a Service
- https://www.fortinet.com/blog/threat-research/diavol-new-ransomware-used-by-wizard-spider Fortinet Diavol July 2021