Loading story…
The newly identified pro-Ukrainian ransomware-as-a-service operation VantaCore has targeted at least seven Russian organizations since August 2026, demanding multimillion-dollar payments through a Tor-based victim-chat service. Russian cybersecurity firm F6 assesses that VantaCore is likely a rebrand of the Thor group; its leak site was established in early June, and the operation appears more financially motivated than its predecessor while retaining an apparent political focus on Russian targets.
VantaCore gains initial access through insecure VPNs and remote-access services, vulnerabilities in internet-facing applications, and credentials stolen from business partners. Its custom toolkit—VantaCore ransomware, VantaCoreLoader, VantaCoreRAT, and SnowKiller—supports payload delivery, encryption, reconnaissance, remote access, file transfers, command execution, and security-tool disabling. Victim data may be published, sold, or used in follow-on activity if ransom demands are not met; F6 characterized the group’s methods as effective but not especially novel or sophisticated.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
VantaCore activity was first detected in August 2026. The pro-Ukrainian ransomware-as-a-service operation, assessed as a likely Thor rebrand, had targeted at least seven known Russian organizations and issued ransom demands reaching millions of dollars.
VantaCore's data-leak website was created in early June 2026, providing a venue for publishing stolen victim data.
F6 attributed at least 12 attacks during 2025 to Thor, a pro-Ukrainian hacking group whose operations combined financial extortion with destructive or politically motivated activity.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Russian-speaking threat group **OldGremlin** carried out a series of ransomware and spearphishing attacks against organizations in Russia, an unusual targeting pattern for a financially motivated group operating in the region. Group-IB linked at least seven phishing campaigns since spring 2020 to the actor, with lures tied to **COVID-19**, media outreach, and the Belarus protests, while impersonating entities including **RBC**, **SRO MiR**, **Novadent**, **Minsk Tractor Works**, and a metallurgical company. Reported victims included a large medical company as well as banks and industrial firms. In one documented intrusion, attackers used a phishing email masquerading as RBC to gain initial access, then deployed custom malware including **TinyNode** and **TinyPosh**, followed by **Cobalt Strike** for post-exploitation. The group established persistence through registry run keys, executed PowerShell and JScript, stole credentials, moved laterally over **RDP** and **SMB**, wiped backups, and finally encrypted the network with **TinyCryptor** ransomware. Group-IB said the operation also used Tor-based command-and-control infrastructure, APC-based process injection, and **RC4**-encrypted communications, aligning the activity with multiple **MITRE ATT&CK** techniques.
Aug 14, 2026
Researchers reported that a ransomware group tracked as **Crypt Ghouls** targeted Russian businesses and government agencies across mining, energy, finance, retail, and public-sector organizations. The group reportedly gained initial access through compromised contractor VPN credentials, then established persistence with **NSSM** and **Localtonet**, harvested credentials using **XenAllPasswordPro** and **Mimikatz**, and expanded access with reconnaissance and lateral-movement tools including **PingCastle**, **SoftPerfect Network Scanner**, **WMI**, **Impacket** `WmiExec.py`, and **PAExec`. The attackers deployed **LockBit 3.0** on Windows systems and **Babuk** on Linux and **ESXi** environments, indicating a multi-platform ransomware capability. Researchers also found overlaps in tooling, infrastructure, and tactics with activity linked to **MorLock**, **BlackJack**, **Twelve**, and **Shedding Zmiy/(Ex)Cobalt**, suggesting collaboration, shared tooling, or intelligence exchange among multiple groups focused on Russian targets.
Jun 29, 2026
Two Russian organizations were simultaneously targeted by separate cyber attack groups, resulting in the exposure of a long-term espionage campaign. The first group, QuietCrabs, believed to be of Asian origin, focused on cyber espionage and maintained a stealthy presence within the victim networks. The second group, known as Thor, attempted to deploy LockBit and Babuk ransomware but was detected early, which inadvertently led to the discovery of QuietCrabs' ongoing activities. Both groups exploited known vulnerabilities in Microsoft SharePoint Server (CVE-2025-53770) and various Ivanti solutions (CVE-2024-21887, CVE-2025-4427, CVE-2025-4428, CVE-2023-38035) to gain initial access. QuietCrabs utilized an ASPX web shell, KrustyLoader malware, and the Sliver C2 implant for persistence and control, while Thor employed tools such as ADRecon, GodPotato, Secretsdump, Mimikatz, Tactical RMM, MeshAgent, and Rclone for lateral movement, privilege escalation, and data exfiltration. The investigation began after Thor's activity was detected, which prevented the ransomware deployment but also revealed the deeper, more persistent espionage threat posed by QuietCrabs. This incident highlights the risk of multiple, unconnected threat actors targeting the same organization and the potential for noisy attacks to expose more covert operations.
Jun 29, 2026