diavol

Executive Summary

Diavol is a medium-sophisticated criminal threat actor associated with ransomware operations, likely linked to the Wizard Spider group. They primarily target organizations for financial gain through ransom demands, utilizing phishing and exploit techniques.

Goals & Targeting

With a focus on financial gain, Diavol targets industries with significant financial resources, such as healthcare and education. Their victims are typically organizations that can afford the ransom and may lack robust security measures, making them prime candidates for exploitation.

Diavol operates as a ransomware group, potentially connected to Wizard Spider. Their modus operandi involves targeting organizations across various sectors to extort ransoms. Using advanced phishing tactics and exploit tools, they deploy ransomware to encrypt systems, demanding cryptocurrency payments for decryption keys.

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Diavol has conducted multiple ransomware campaigns, leveraging their technical capabilities to target various sectors. Their operations often involve high-volume attacks with notable increases in activity during certain periods.

IOC Patterns

• Spear-phishing emails with malicious attachments
• Use of cryptocurrency wallets for payments
• Encrypted files with specific extensions

Recommended Actions

• Implement multi-layered email filtering to detect phishing attempts
• Perform regular system backups and ensure they are offline-secured
• Provide employee training on recognizing suspicious emails and attachments

Suggested Tags