F6 Reports VantaCore Ransomware Group Is Targeting Russian Organizations
Summary
F6 says VantaCore, possibly a rebrand of Thor, has targeted at least seven Russian victims with custom ransomware and multimillion-dollar demands. The group uses a RaaS model as pro-Ukraine hackers increasingly develop their own tools.
Key points
- F6 reports at least seven known VantaCore victims; researchers first detected activity in August, and its leak site appears to date to early June.
- Researchers believe VantaCore is a rebrand of Thor, which F6 attributed at least 12 attacks to in 2025.
- F6 says VantaCore primarily seeks financial gain, with ransom demands reaching millions of dollars.
- The group reportedly exploits poorly secured VPNs and other remote-access tools, internet-facing application flaws, and credentials stolen from business partners.
- Its custom tools include VantaCore ransomware, VantaCoreLoader, VantaCoreRAT, and SnowKiller, which is designed to disable security software.
- F6 reports a broader shift in 2025 and 2026 toward custom ransomware among pro-Ukraine groups, replacing tools such as LockBit 3 Black and Babuk.
Article Details
- Event Type
- A ransomware group calling itself VantaCore is targeting Russian organizations with custom-built malware and multimillion-dollar ransom demands.
- Impact
- F6 reports at least seven known VantaCore victims. The group can encrypt data, collect information from infected systems, transfer files, remotely execute commands, and disable security software. Stolen data may also be published or sold and potentially used in further operations. Researchers believe VantaCore may be a rebrand of Thor.
Threat Actors
Malware
BabukF6 says the group has attacked at least seven victims, uses a ransomware-as-a-service model, and reflects a broader shift among pro-Ukrainian hackers toward in-house tooling instead of LockBit 3 Black and Babuk.LockBit 3 BlackF6 says the group has attacked at least seven victims, uses a ransomware-as-a-service model, and reflects a broader shift among pro-Ukrainian hackers toward in-house tooling instead of LockBit 3 Black and Babuk.SnowKillerVantaCore uses custom tools including VantaCore ransomware, VantaCoreLoader, VantaCoreRAT, and SnowKiller.VantaCoreVantaCore is a ransomware group believed to be a rebrand of Thor, targeting Russian organizations with custom-built malware and multimillion-dollar ransom demands.VantaCoreLoaderVantaCore uses custom tools including VantaCore ransomware, VantaCoreLoader, VantaCoreRAT, and SnowKiller.VantaCoreRATVantaCore uses custom tools including VantaCore ransomware, VantaCoreLoader, VantaCoreRAT, and SnowKiller.