Diavol

Diavol is a Windows ransomware family linked by multiple technical and operational overlaps to the TrickBot ecosystem, including Wizard Spider, and observed in proximity to Conti operations. Public reporting places its emergence in 2021, with some development-stage samples indicating earlier internal evolution. It has been associated with the broader TrickBot/Conti cluster and has been described as sharing code patterns, bot-identification logic, command-line conventions, and other implementation traits with TrickBot- and Conti-related tooling.

Diavol is a 64-bit ransomware that supports local and network-focused encryption workflows. It can generate victim and bot identifiers, collect host information such as username and local and external IP data, register infected systems to command-and-control infrastructure over HTTP using GET and POST requests, and retrieve updated configuration elements remotely. Its reconnaissance features include enumeration of local drives, network shares, and SMB-accessible resources, including discovery of shares via dedicated commands and share-enumeration APIs. It can also stop selected services, terminate processes, and attempt to stop security software prior to encryption.

The malware encrypts files using a hybrid design involving RSA and XOR-based processing, with partial or block-based encryption behavior documented across analyzed variants. It appends encryption-related metadata to affected files, drops ransom notes, and changes the desktop wallpaper. Diavol also inhibits recovery by deleting Volume Shadow Copies, with reporting describing both command-shell-based deletion and use of VSS-related interfaces such as IVssBackupComponents to enumerate and remove snapshots. Some analyses noted shellcode-loaded core functionality and resource-based storage of code and imports as anti-analysis or implementation features.

Observed tradecraft indicates post-compromise deployment in enterprise intrusions rather than broad indiscriminate self-propagation. Diavol has been seen alongside Conti in at least one reported incident and has been discussed as a possible test or parallel ransomware effort within the TrickBot-associated criminal ecosystem. Victimology in the supplied reporting is not sufficiently specific to assign a narrow sector focus, but the malware is clearly intended for organizational ransomware operations involving network discovery, impact, and in some cases extortion claims involving data theft.