Devos

Devos is a variant of the Phobos ransomware, a type of malicious software designed to exploit and damage computer systems. According to open-source reports, Devos is likely connected to numerous other variants such as Elking, Eight, Backmydata, and Faust due to similar Tactics, Techniques, and Procedures (TTPs) observed in Phobos intrusions. In addition to Devos, Eking, Eight, Elbie, and Faust are the most common Phobos variants, appearing most frequently across analyzed samples. These variants can infiltrate systems through suspicious downloads, emails, or websites, often without user knowledge, and then proceed to steal personal information, disrupt operations, or hold data for ransom. The affiliates of Devos have been observed using various email providers, with QQ[.]com, a Chinese instant messaging application, and ICQ, an instant messaging service owned by a Russian company, being the most notable ones. The broad range of email domains used by these affiliates suggests a complex and wide-reaching infrastructure supporting their activities. Furthermore, it was noted that Devos and its affiliates also use a variety of file extensions, including but not limited to 'faust', 'actin', 'DIKE', 'Acuna', 'fullz', 'GrafGrafel', 'kmrox', 's0m1n', 'qos', 'cg', and 'ext'. This diversity in file extensions further demonstrates the adaptability and sophistication of this malware variant. In March 2024, the US Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the Multi-State Information Sharing and Analysis Center (MS-ISAC) issued a joint cybersecurity advisory to warn of attacks involving Phobos ransomware variants like Devos, Eight, Elking, and Faust. This advisory indicates the serious threat these ransomware variants pose to cybersecurity and emphasizes the need for robust protective measures against them. The ongoing activities of Devos and its affiliates highlight the persistent and evolving nature of cyber threats in our increasingly digital world.