VantaCore, a new pro-Ukraine hacker group, targets Russian companies with custom ransomware

New Ransomware Group Emerges

A new pro-Ukrainian hacker group, identified as VantaCore, has begun targeting Russian organizations with custom ransomware. The group demands multi-million dollar payments from its victims. Researchers first detected VantaCore's activity in August, with its data-leak website appearing in early June.

Connection to Previous Operations

Cybersecurity firm F6 suggests that VantaCore is a rebrand of Thor, another pro-Ukrainian hacking group active in 2023. Thor was responsible for at least 12 attacks, combining financial extortion with destructive or politically motivated actions. VantaCore, however, appears to be primarily focused on financial gain.

Operational Model and Tactics

VantaCore operates as a ransomware-as-a-service (RaaS) model, providing malware and infrastructure to affiliates. They communicate with victims via a Tor-based chat service and maintain a leak site for stolen data. The group employs common infiltration methods, including exploiting poorly secured VPNs, flaws in internet-facing applications, and stolen login credentials.

Custom Toolset

What distinguishes VantaCore is its reliance on a suite of custom-built hacking tools. These include the VantaCore ransomware for encrypting data on servers and employee computers, VantaCoreLoader for distributing malware, VantaCoreRAT for system information gathering and remote execution, and SnowKiller, designed to disable security software like antivirus products.