Discovery Enum
- AdFind
- Advanced IP Scanner
- ShareFinder
Diavol
Diavol is a Windows ransomware family associated with the TrickBot and Conti cybercrime ecosystem and operated by actors tracked as DEV-0193, with reporting also linking its distribution to GOLD ULRICK.
Profile source: Mallory opens in a new tabDiavol
Family profile
Diavol is a Windows ransomware family associated with the TrickBot and Conti cybercrime ecosystem and operated by actors tracked as DEV-0193, with reporting also linking its distribution to GOLD ULRICK. It emerged as one of the ransomware strains used alongside or after Ryuk and Conti within the same broader criminal network.
Diavol encrypts victim files using RSA through the Windows CryptEncrypt API and has been observed appending a distinct encrypted-file extension. It also inhibits recovery by deleting Volume Shadow Copies through the IVssBackupComponents COM interface and can delete selected files from compromised systems. Post-encryption, it modifies the victim desktop by creating a ransom-themed wallpaper and changing the background to display an extortion message.
The malware includes multiple pre-encryption and operational capabilities that support enterprise-wide impact. It can collect the username from a compromised host, communicate with command-and-control infrastructure over HTTP using GET and POST requests, attempt to stop security software, and use the ARP table to identify remote hosts for scanning. Diavol has also been observed spreading through Windows SMB shares prior to encryption, enabling propagation across internal networks.
Diavol is best understood as part of the financially motivated, human-operated ransomware tradecraft surrounding TrickBot and Conti rather than as a standalone commodity strain. Its observed behavior aligns with double-extortion-era ransomware operations that combine host discovery, defense evasion, lateral spread, recovery inhibition, and disruptive victim messaging to maximize pressure on targeted organizations.
Capabilities
- Defense Evasion
- Exfiltration
- Lateral Movement
- Reconnaissance
- Scanning
Operational record
1
YARA rules
2
Ransom notes
1
Leak sites
0 available
Exfiltration
- FileZilla
Offsec
- Cobalt Strike
- Rubeus
RMM Tools
- AnyDesk
Reported operators
Threat actors
3 named in public reportingDEV-0193 managed the Ryuk RaaS program before the latter’s shutdown in June 2021, and Ryuk’s successor, Conti as well as Diavol.
...Stern has transacted with addresses linked to strains like Quantum, Karakurt, Diavol, and Royal in 2022 following Conti’s demise.
...deployment of ransomware including Conti and Diavol.
MITRE ATT&CK
Diavol in ATT&CK
21 distinct techniquesTechniques
21 techniques T1486 Data Encrypted for Impact T1082 System Information Discovery T1083 File and Directory Discovery T1071.001 Web Protocols T1016 System Network Configuration Discovery T1033 System Owner/User Discovery T1057 Process Discovery T1027 Obfuscated Files or Information T1490 Inhibit System Recovery T1018 Remote System Discovery T1562.001 Disable or Modify Tools T1562 Impair Defenses T1657 Financial Theft T1485 Data Destruction T1135 Network Share Discovery T1027.003 Steganography T1105 Ingress Tool Transfer T1021.002 SMB/Windows Admin Shares T1489 Service Stop T1491.001 Internal Defacement T1106 Native API
Reporting
Research mentioning Diavol
Jul 16
Register Security
Telegram shortlinks knocked offline over sanctioned VPN connection
The U.S. Treasury sanctioned First VPN Service (1VPNS), its alleged Ukrainian administrator Dmytro Rashevskyi, and Belarusian cryptor seller Yevgeniy Vladimirovich Silayev for allegedly supporting ransomware and other cybercriminal activity. Officials said 1VPNS provided anonymizing infrastructure that helped threat actors hide their identities, disguise malware, and evade detection during attacks on U.S. municipalities, hospitals, schools, businesses, and critical infrastructure providers. Treasury alleged Rashevskyi used false identities to obtain infrastructure for the service, while Silayev sold malware-obfuscation tools that made malicious code harder for defenders to detect. The sanctions, issued under Executive Order 14390 and E.O. 13694 as amended, block U.S. persons from transacting with the designated parties and mark a broader move against ransomware enablers rather than only the gangs themselves. The action was coordinated with the United Kingdom and followed a May law enforcement takedown of 1VPNS infrastructure by European agencies with FBI support. Separate reporting said blockchain tracing tied payments from ransomware groups including Anubis, Qilin, and Sinobi Group to FirstVPN, adding financial evidence that the service was used as operational infrastructure by ransomware actors.
Jul 15
Scworld
U.S. sanctions VPN provider and cryptor seller for aiding ransomware gangs | brief | SC Media
Jul 15
Xakep
Власти США наложили санкции на First VPN из-за связей с вымогателями - Хакер
Jul 14
Security Affairs
U.S. Treasury Sanctions VPN Provider and Cryptor Seller Behind Billions in Ransomware Losses
Jul 14
Cyberscoop
US sanctions First VPN and administrator for supporting ransomware | CyberScoop
Jul 14
Chainalysis
“Stern” Ransomware Operator Sanctioned by EU
Jul 14
Cyber Security News
US Treasury Sanctions VPN Service that Helped Ransomware Actors to Attack Organizations
Jul 14
The Hacker News
