Analysis of Diavol Ransomware reveals possible link to TrickBot gang

Category	Details
Threat Actors	Likely linked to the TrickBot group (ITG23), a well-known cybercrime Syndicate behind TrickBot malware, Ryuk, and Conti.
Campaign Overview	Development and evolution of Diavol ransomware; observed in early testing and active versions targeting victims for encryption and botnet registration.
Target Regions	Indications of preference for Russian and CIS regions in early versions; possible targeting of global victims in active versions.
Methodology	- Encrypts files using RSA. - Prioritizes files based on extensions. - Terminates processes and services. - Connects to C2 for botnet registration.
Product Targeted	Windows systems (various versions).
Malware Reference	Diavol ransomware (development sample MD5: e63a532d42b44ff73c1e1d4bda018657, active sample SHA256: 85ec7f5ec91adf7c104c7e116511ac5e7945bcf4a8fdecdcc581e97d8525c5ac).
Tools Used	TrickBot modular platform, CryptoAPI for encryption, configuration stored in PE overlay.
Vulnerabilities Exploited	Exploits unsecured remote access protocols (e.g., RDP) and weak configurations to gain entry.
TTPs	- Encrypts files with high priority. - Terminates processes/services. - Botnet registration with unique Bot IDs.
Attribution	Ties to TrickBot due to similarities in botnet registration methods, HTTP header preferences, and group ID usage.
Recommendations	- Use offline backups stored securely. - Implement MFA on all remote access. - Employ user behavior analytics. - Limit RDP access.
Source	Security Intelligence

Read full article: Read More
Disclaimer: The above summary has been generated by an AI language model.