Diavol

Diavol is a type of malware, specifically ransomware, that infiltrates systems to exploit and cause damage. It can infect systems through various channels such as suspicious downloads, emails, or websites, often unbeknownst to the user. Once inside, Diavol can steal personal information, disrupt operations, or hold data hostage for ransom. A decryption tool has been developed by Emsisoft to combat this threat, with guides available for users to navigate the process of removing the ransomware from their systems. The group behind Diavol expanded its operations over time, developing and operating new forms of malware like BazarLoader and Anchor. These were used to gain a foothold in victim environments for subsequent ransomware attacks. The same actors also developed and operated the Ryuk, Conti, and Diavol ransomware operations. In one notable intrusion, a BazarLoader infection resulted in the deployment of Diavol Ransomware, showcasing the group's adaptability to the evolving ransomware economy. More recently, an attack was attempted using the same version of AdFind to deliver the Diavol payload. The group has also upgraded components of its operations, including web-inject and Virtual Network Computing modules, and possibly the new Diavol ransomware. Notably, researchers found links between the Karakurt and Diavol groups and Conti, revealing a network of malicious actors working together. Despite these advancements, some similarities have been noted in the ransom notes of different ransomware, suggesting potential red herrings planted by Diavol’s authors.