Skip to navigation

Threat reportRansomwareTL-2026-5286

DIAVOL Ransomware – Reverse Engineering Analysis (Wizard Spider-linked, .lock64)

highACTIVE

DIAVOL is a 64-bit Windows ransomware that partially encrypts files with RSA only (default 10%, 2048-byte blocks), appends .lock64 and drops README-FOR-DECRYPT.txt. It terminates processes and services, deletes shadow copies and can pull configuration from a C2. The FBI and IBM X-Force link it to the TrickBot / Wizard Spider operators. First disclosed .

Key facts for Diavol ransomware

IdentifiersTL-2026-5286
Also known asDiavol, .lock64
SeverityHIGH
First disclosed
Exploitation statusNo known exploitation
Affected productsMicrosoft Windows (64-bit)
AttributionPeriwinkle Tempest (medium confidence)
Nation-state nexusRussia
MalwareAnchor - S0504, Conti, Diavol - S0659, TrickBot
ToolsTrick Bot
MITRE ATT&CK techniquesT1007 System Service Discovery, T1021.002 Remote Services: SMB/Windows Admin Shares, T1027 Obfuscated Files or Information, T1027.009 Obfuscated Files or Information: Embedded Payloads, T1057 Process Discovery, T1059.003 Command and Scripting Interpreter: Windows Command Shell, T1070.004 Indicator Removal: File Deletion, T1071.001 Application Layer Protocol: Web Protocols, T1106 Native API, T1135 Network Share Discovery, T1489 Service Stop, T1490 Inhibit System Recovery and 3 more in the attack flow
MotivationFINANCIAL
Detection rules9 (1 shown free)
Sources9 cited sources

Detection coverage for Diavol ransomware

As of 2026-11-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5286 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: DIAVOL Ransomware - Shadow Copy Deletion via vssadmin Delete Shadows /All /Quiet

Detects the pre-encryption recovery-inhibition step used by DIAVOL (Wizard Spider / TrickBot-linked, .lock64) in TL-2026-5286: vssadmin.exe launched with 'Delete Shadows /All /Quiet'. The exact DIAVOL command line is flagged separately (diavol_exact_cmd=1) while generic vssadmin shadow deletion is still surfaced for triage. Shadow-copy deletion is a high-fidelity ransomware precursor regardless of family.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1490, T1059.003
  • Data sources: sysmon, index=endpoint sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational, DeviceProcessEvents
  • Severity: high
  • Confidence: high

Splunk SPL

index=endpoint sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h (Image="*vssadmin.exe" OR OriginalFileName="VSSADMIN.EXE") CommandLine="*delete*" CommandLine="*shadows*" CommandLine="*/all*"
``` DIAVOL (TL-2026-5286) runs: vssadmin Delete Shadows /All /Quiet ```
| eval diavol_exact_cmd=if(like(lower(CommandLine), "%delete shadows /all /quiet%"), 1, 0)
| eval quiet_flag=if(like(lower(CommandLine), "%/quiet%"), 1, 0)
| table _time host user ParentImage ParentCommandLine Image CommandLine diavol_exact_cmd quiet_flag
| sort - diavol_exact_cmd - _time

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "vssadmin.exe"
| where ProcessCommandLine has_all ("delete", "shadows") and ProcessCommandLine has "/all"
| extend DiavolExactCmd = tolower(ProcessCommandLine) contains "delete shadows /all /quiet"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, ProcessCommandLine, DiavolExactCmd
| order by DiavolExactCmd desc, Timestamp desc

Sigma

title: DIAVOL Ransomware Shadow Copy Deletion via vssadmin
id: 6b1f3c52-8a47-4e0d-9d1a-2c5e7f4b9a11
status: experimental
description: Detects vssadmin Delete Shadows /All /Quiet as executed by DIAVOL ransomware before encryption (TL-2026-5286).
references:
    - https://www.ic3.gov/Media/News/2022/220120.pdf
    - https://www.chuongdong.com/reverse%20engineering/2021/12/17/DiavolRansomware/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-05
tags:
    - attack.impact
    - attack.t1490
    - attack.execution
    - attack.t1059.003
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\vssadmin.exe'
        CommandLine|contains|all:
            - 'delete'
            - 'shadows'
            - '/all'
    condition: selection
falsepositives:
    - Backup or storage administrators purging shadow copies during maintenance
    - Disk cleanup scripts run by IT
level: high

Known false positives:

  • Backup/storage administrators deleting shadow copies during planned maintenance
  • Disk-space cleanup scripts or imaging tools that call vssadmin delete shadows

Tuning notes: Replace index=endpoint with the index holding Sysmon data. Allowlist known backup-server hosts and service accounts by host/user. Alert at critical severity when diavol_exact_cmd=1 or when the parent is cmd.exe/powershell.exe spawned from a user-writable path. Correlate with SPL-002 service stops on the same host.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • DIAVOL Ransomware - [indicator] Encrypted Files, [indicator] Note and Wallpaper Change · unlock with TL Creds
  • DIAVOL Ransomware - Execution Command Lines, Shadow Deletion and Self-Deletion · unlock with TL Creds
  • DIAVOL Ransomware - C2 Config Server Contact and SMB Share Fan-Out · unlock with TL Creds
  • DIAVOL Ransomware - Ransom Note and [indicator] File Creation (Sigma primary) · unlock with TL Creds
  • DIAVOL Ransomware - Shadow Deletion, [indicator] Execution and Self-Deletion (Sigma primary) · unlock with TL Creds
  • DIAVOL Ransomware - HTTP C2 URIs and 'Agent' User-Agent (Sigma primary) · unlock with TL Creds
  • DIAVOL Ransomware - Mass Backup/Database/Security Service Stop · unlock with TL Creds
  • DIAVOL Ransomware - HTTP C2 Registration and Config Fetch ([indicator]) · unlock with TL Creds

Indicators of compromise for Diavol ransomware

As of 2026-11-05, Threadlinqs Intelligence tracks 14 indicators of compromise for TL-2026-5286.

Sample indicators (3 of 14)

  • IP address: 173.232.146[.]118
  • File hash: f4928b5365a0bd6db2e9d654a77308d7
  • File hash: ee13d59ae3601c948bd10560188447e6faaeef5336dcd605b52ee558ff2a8588

Defanged, TLP:CLEAR. Full set of 14 indicators: unlock with TL Creds.

14 indicators of compromise · unlock with TL Creds. Compare plans

How Diavol ransomware works

DIAVOL (also spelled Diavol) was first described publicly by Fortinet on 2021-07-03 after FortiEDR stopped an attack in early June 2021. IBM X-Force later traced a sample submitted to VirusTotal on 2021-01-27 with a reported compile date of 2020-03-05. The FBI issued a Flash alert on 2022-01-20 formally linking Diavol to the TrickBot gang and reporting ransom demands between $10,000 and $500,000, with operators willing to negotiate lower payments.

The Chuong Dong reverse-engineering write-up (2021-12-17) shows that the core routines are position-independent shellcodes stored as bitmap images in the PE resource section and loaded at runtime (resource names include GENBOTID, REGISTER, FROMNET, SERVPROC, KILLPR, RSAINIT, ENMDSKS, SMBFAST, SMB, FINDFILES, ENCDEFILE, VSSMOD and CHNGDESK). Fortinet counted 14 such routines. APIs are resolved through offset tables and sensitive command strings are built as stackstrings. The sample is compiled with Microsoft Visual C/C++.

On start-up the malware builds a bot ID of the form <computer>_<user>_W<OS version>.<GUID>, which IBM and the FBI note is nearly identical to the Bot ID produced by TrickBot's Anchor DNS malware. It registers with a hard-coded registration server (127.0.0.1 in the analyzed sample, expected to be overridden) via HTTP POST to /BnpOnspQwtjCA/register using the User-Agent 'Agent', a Content-Type of application/x-www-form-urlencoded; charset=UTF-8 and a body of cid=<bot_ID>&group=<group_ID>&ip_local1=&ip_local2=&ip_external=. The group ID in the sample is c1aaee. It fetches configuration fields from a hard-coded config server, 173.232.146.118, via /Bnyar8RsK04ug/<bot_ID>/<group_ID>/<field_name>. IBM observed HTTP headers preferring Russian-language content and a system-language check intended to avoid infecting Russia/CIS systems (Fortinet reported that, unlike Conti, Diavol does not avoid Russian victims in the sample it examined).

Encryption uses an RSA public key only, with no symmetric cipher (CryptAcquireContextW, CryptImportKey, CryptEncrypt). Files are read in 2048-byte blocks, encrypted and written back; the percentage of each file encrypted is set with -perc (default 10%). An RSA footer, the maximum encrypted size and its negation are appended to the file. File selection is driven by attacker-configured extension lists. Command-line options are -p <path> (target file list), -h <path> (remote targets for SMB enumeration), -m [local|net|scan|all] (mode), -log <filename>, -s <IP> (C2 override) and -perc <percent>. Network shares are enumerated with NetShareEnum and encrypted over SMB. Before encryption the malware terminates a long list of processes (browsers, databases such as oracle.exe/sqlservr.exe/mysql.exe, Office applications, and security tools such as tmlisten.exe and mbamtray.exe) and stops services (Veeam*, BackupExec*, MSSQL*, SQLAgent*, Sophos*, Kaspersky*, McAfee*, Symantec*) through the Service Control Manager. It deletes shadow copies with 'vssadmin Delete Shadows /All /Quiet', changes the desktop wallpaper, writes the ransom note README-FOR-DECRYPT.txt (Tor-based payment instructions, with %cid_bot% replaced by the victim ID) and finally deletes itself with cmd.exe /c del.

The ransom note threatens data leakage, but Fortinet and IBM found no data-stealing code in the samples analyzed, and the FBI had not observed Diavol operators leaking victim data. Fortinet observed Diavol delivered alongside a Conti v3 locker (locker64.dll) on a host where TrickBot infrastructure was in use; the initial intrusion vector was not identified. Severity and ACTIVE status are analyst-assigned: the sources are 2021-2022 and none states current activity.

MITRE ATT&CK techniques by tactic:

Discovery

T1007 System Service Discovery; T1057 Process Discovery; T1135 Network Share Discovery; T1614.001 System Location Discovery: System Language Discovery

Lateral Movement

T1021.002 Remote Services: SMB/Windows Admin Shares

Defense Evasion

T1027 Obfuscated Files or Information; T1027.009 Obfuscated Files or Information: Embedded Payloads; T1070.004 Indicator Removal: File Deletion

Execution

T1059.003 Command and Scripting Interpreter: Windows Command Shell; T1106 Native API

Command and Control

T1071.001 Application Layer Protocol: Web Protocols

Impact

T1489 Service Stop; T1490 Inhibit System Recovery; T1491.001 Defacement: Internal Defacement

defense-impairment

T1685 Disable or Modify Tools

Remediation for Diavol ransomware

Immediate actions

  • Block 173.232.146.118 at the perimeter and alert on HTTP requests to the /BnpOnspQwtjCA/register and /Bnyar8RsK04ug/ URI paths
  • Alert on 'vssadmin Delete Shadows /All /Quiet' and on mass service/process termination of backup, database and security products
  • Hunt for files with the .lock64 extension and README-FOR-DECRYPT.txt ransom notes
  • Search for the published MD5/SHA256 hashes and for locker.exe / locker64.dll on endpoints

Workarounds

  • Restrict who can run vssadmin and enable monitoring of shadow-copy deletion
  • Block the User-Agent 'Agent' on outbound HTTP where it is not used legitimately

Longer-term hardening

  • Maintain offline, tested backups of critical data, including backup-server and database data
  • Deploy EDR with tamper protection so security services cannot be stopped
  • Segment networks and restrict SMB access to limit share-based encryption
  • Hunt for TrickBot and Conti precursor activity, since Diavol has been observed alongside TrickBot infrastructure

Affected and fixed versions

  • Microsoft — Windows (64-bit)
    Vulnerable versions: Windows systems reachable by the 64-bit payload; no specific versions stated in sources

Timeline of Diavol ransomware

  • Reported compilation date of the earliest locked-ioc-13 sample analyzed by IBM X-Force
  • locked-ioc-13 development-version sample submitted to VirusTotal (IBM X-Force)
  • Early June 2021: FortiEDR detected and halted a locked-ioc-13 attack against a customer; a locked-ioc-14 v3 locker (locked-ioc-8) was seen alongside locked-ioc-9
  • Fortinet publishes the first public analysis of locked-ioc-13 and speculates it was developed by locked-ioc-7
  • IBM X-Force publishes analysis showing locked-ioc-13's Bot ID format is nearly identical to locked-ioc-11's Anchor DNS, plus Russian-language header preference and CIS avoidance
  • Chuong Dong publishes a full reverse-engineering analysis (shellcode resources, RSA footer, C2 endpoints, command-line options)
  • FBI Flash alert links locked-ioc-13 to the locked-ioc-11 gang, reports ransom demands of $10,000 to $500,000 and publishes IOCs and mitigations

Sources cited for Diavol ransomware

More from Periwinkle Tempest

Previous and next in ransomware

Drafted by the Threadlinqs research pipeline from 9 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats