#ParsedReport #CompletenessLow
02-09-2026

Ragnarök: F6 Investigated Attacks by the VantaCore Ransomware Group

https://www.f6.ru/blog/vantacore/

Report completeness: Low

Actors/Campaigns:
Vantacore
Bearlyfy
Thor

Threats:
Lockbit
Babuk
Genielocker
Wevtutil_tool
Edr-killer
Byovd_technique
Tactical_rmm_tool
Vantacorerat
Psexec_tool
Snowkiller_tool
Garble_tool

Victims:
Russian businesses, Russian legal entities, Russian individuals

Geo:
Russian

ChatGPT TTPs:
do not use without manual check
T1018, T1021.001, T1021.002, T1027, T1059, T1059.001, T1070.001, T1078, T1087, T1090, have more...

IOCs:
File: 30

Soft:
Telegram, VKontakte, Viber, WhatsApp

Algorithms:
chacha20, curve25519

Win Services:
MsMpEng, ekrn, AvastSvc, MBAMService, kavfsgt, klnagent

Languages:
powershell