VantaCoreThreat actor
VantaCore is a ransomware group believed to be a rebrand of Thor, targeting Russian organizations with custom-built malware and multimillion-dollar ransom demands. F6 says the group has attacked at least seven victims, uses a ransomware-as-a-service model, and reflects a broader shift among pro-Ukrainian hackers toward in-house tooling instead of LockBit 3 Black and Babuk.From MISP Galaxy
Last reported 1 month ago, by Risky Business News1 report
ATT&CK techniques
3 techniques · each with the sentence it comes from- T1027.017SVG Smuggling
“SVG smuggling campaign: Kaseya's INKY team has spotted a massive email spam campaign using SVG smuggling to assemble a phishing page right in the user's browser.”
- T1110.003Password Spraying
“AWS password spraying campaign: A password spraying campaign has targeted the root user accounts of AWS tenants.”
- T1684Social Engineering
“Spring Ring campaign: A hacking group has targeted more than 150 employees across at least 10 companies as part of a coordinated social engineering campaign.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Risky Bulletin: BGP hijack targets Virtualizor to deliver malicious updates“VantaCore profile: A new pro-Ukrainian hacking group is targeting Russian companies with ransomware.”
Indicators in its reports
named in the reports above- zet[.]netin 1 report
- www.virtualizor[.]comin 1 report
- eldomador.bsky[.]socialin 1 report
- infosec[.]exchangein 1 report
Copy these 4 indicators · defanged
Thanks — we review every report.