# DIAVOL Ransomware – Reverse Engineering Analysis (Wizard Spider-linked, .lock64) > DIAVOL is a 64-bit Windows ransomware that partially encrypts files with RSA only (default 10%, 2048-byte blocks), appends .lock64 and drops README-FOR-DECRYPT.txt. It terminates processes and services, deletes shadow copies and can pull configuration from a C2. The FBI and IBM X-Force link it to the TrickBot / Wizard Spider operators. - **Published:** 2026-11-05T01:54:10Z - **Last reviewed:** 2026-11-05T01:54:10Z - **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5286 - **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5286.png - **ID:** TL-2026-5286 - **Severity:** HIGH - **Category:** RANSOMWARE - **Status:** ACTIVE - **Actor:** Periwinkle Tempest (Russia) - **Detections:** 9 (1 shown free below) · **IOCs:** 14 (3 shown free below) ## Description DIAVOL (also spelled Diavol) was first described publicly by Fortinet on 2021-07-03 after FortiEDR stopped an attack in early June 2021. IBM X-Force later traced a sample submitted to VirusTotal on 2021-01-27 with a reported compile date of 2020-03-05. The FBI issued a Flash alert on 2022-01-20 formally linking Diavol to the TrickBot gang and reporting ransom demands between $10,000 and $500,000, with operators willing to negotiate lower payments. The Chuong Dong reverse-engineering write-up (2021-12-17) shows that the core routines are position-independent shellcodes stored as bitmap images in the PE resource section and loaded at runtime (resource names include GENBOTID, REGISTER, FROMNET, SERVPROC, KILLPR, RSAINIT, ENMDSKS, SMBFAST, SMB, FINDFILES, ENCDEFILE, VSSMOD and CHNGDESK). Fortinet counted 14 such routines. APIs are resolved through offset tables and sensitive command strings are built as stackstrings. The sample is compiled with Microsoft Visual C/C++. On start-up the malware builds a bot ID of the form __W., which IBM and the FBI note is nearly identical to the Bot ID produced by TrickBot's Anchor DNS malware. It registers with a hard-coded registration server (127.0.0.1 in the analyzed sample, expected to be overridden) via HTTP POST to /BnpOnspQwtjCA/register using the User-Agent 'Agent', a Content-Type of application/x-www-form-urlencoded; charset=UTF-8 and a body of cid=&group=&ip_local1=&ip_local2=&ip_external=. The group ID in the sample is c1aaee. It fetches configuration fields from a hard-coded config server, 173.232.146.118, via /Bnyar8RsK04ug///. IBM observed HTTP headers preferring Russian-language content and a system-language check intended to avoid infecting Russia/CIS systems (Fortinet reported that, unlike Conti, Diavol does not avoid Russian victims in the sample it examined). Encryption uses an RSA public key only, with no symmetric cipher (CryptAcquireContextW, CryptImportKey, CryptEncrypt). Files are read in 2048-byte blocks, encrypted and written back; the percentage of each file encrypted is set with -perc (default 10%). An RSA footer, the maximum encrypted size and its negation are appended to the file. File selection is driven by attacker-configured extension lists. Command-line options are -p (target file list), -h (remote targets for SMB enumeration), -m [local|net|scan|all] (mode), -log , -s (C2 override) and -perc . Network shares are enumerated with NetShareEnum and encrypted over SMB. Before encryption the malware terminates a long list of processes (browsers, databases such as oracle.exe/sqlservr.exe/mysql.exe, Office applications, and security tools such as tmlisten.exe and mbamtray.exe) and stops services (Veeam*, BackupExec*, MSSQL*, SQLAgent*, Sophos*, Kaspersky*, McAfee*, Symantec*) through the Service Control Manager. It deletes shadow copies with 'vssadmin Delete Shadows /All /Quiet', changes the desktop wallpaper, writes the ransom note README-FOR-DECRYPT.txt (Tor-based payment instructions, with %cid_bot% replaced by the victim ID) and finally deletes itself with cmd.exe /c del. The ransom note threatens data leakage, but Fortinet and IBM found no data-stealing code in the samples analyzed, and the FBI had not observed Diavol operators leaking victim data. Fortinet observed Diavol delivered alongside a Conti v3 locker (locker64.dll) on a host where TrickBot infrastructure was in use; the initial intrusion vector was not identified. Severity and ACTIVE status are analyst-assigned: the sources are 2021-2022 and none states current activity. ## MITRE ATT&CK - T1490 Inhibit System Recovery - T1489 Service Stop - T1491.001 Defacement: Internal Defacement - T1685 Disable or Modify Tools - T1027.009 Obfuscated Files or Information: Embedded Payloads - T1027 Obfuscated Files or Information - T1070.004 Indicator Removal: File Deletion - T1106 Native API - T1059.003 Command and Scripting Interpreter: Windows Command Shell - T1057 Process Discovery - T1007 System Service Discovery - T1135 Network Share Discovery - T1614.001 System Location Discovery: System Language Discovery - T1021.002 Remote Services: SMB/Windows Admin Shares - T1071.001 Application Layer Protocol: Web Protocols ## Free detection (Splunk SPL, Microsoft KQL, Sigma) **DIAVOL Ransomware - Shadow Copy Deletion via vssadmin Delete Shadows /All /Quiet** (`TL-2026-5286-SPL-001`) Detects the pre-encryption recovery-inhibition step used by DIAVOL (Wizard Spider / TrickBot-linked, .lock64) in TL-2026-5286: vssadmin.exe launched with 'Delete Shadows /All /Quiet'. The exact DIAVOL command line is flagged separately (diavol_exact_cmd=1) while generic vssadmin shadow deletion is still surfaced for triage. Shadow-copy deletion is a high-fidelity ransomware precursor regardless of family. - **Languages:** Splunk SPL, Microsoft KQL, Sigma - **ATT&CK:** T1490, T1059.003 - **Data sources:** sysmon, index=endpoint sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational, DeviceProcessEvents - **Severity:** high - **Confidence:** high ### Splunk SPL ````spl index=endpoint sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h (Image="*vssadmin.exe" OR OriginalFileName="VSSADMIN.EXE") CommandLine="*delete*" CommandLine="*shadows*" CommandLine="*/all*" ``` DIAVOL (TL-2026-5286) runs: vssadmin Delete Shadows /All /Quiet ``` | eval diavol_exact_cmd=if(like(lower(CommandLine), "%delete shadows /all /quiet%"), 1, 0) | eval quiet_flag=if(like(lower(CommandLine), "%/quiet%"), 1, 0) | table _time host user ParentImage ParentCommandLine Image CommandLine diavol_exact_cmd quiet_flag | sort - diavol_exact_cmd - _time ```` ### Microsoft KQL ```kql DeviceProcessEvents | where Timestamp > ago(24h) | where FileName =~ "vssadmin.exe" | where ProcessCommandLine has_all ("delete", "shadows") and ProcessCommandLine has "/all" | extend DiavolExactCmd = tolower(ProcessCommandLine) contains "delete shadows /all /quiet" | project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, ProcessCommandLine, DiavolExactCmd | order by DiavolExactCmd desc, Timestamp desc ``` ### Sigma ```yaml title: DIAVOL Ransomware Shadow Copy Deletion via vssadmin id: 6b1f3c52-8a47-4e0d-9d1a-2c5e7f4b9a11 status: experimental description: Detects vssadmin Delete Shadows /All /Quiet as executed by DIAVOL ransomware before encryption (TL-2026-5286). references: - https://www.ic3.gov/Media/News/2022/220120.pdf - https://www.chuongdong.com/reverse%20engineering/2021/12/17/DiavolRansomware/ author: AII-Detector — ThreadLinqs Intelligence date: 2026-11-05 tags: - attack.impact - attack.t1490 - attack.execution - attack.t1059.003 logsource: category: process_creation product: windows detection: selection: Image|endswith: '\vssadmin.exe' CommandLine|contains|all: - 'delete' - 'shadows' - '/all' condition: selection falsepositives: - Backup or storage administrators purging shadow copies during maintenance - Disk cleanup scripts run by IT level: high ``` **Known false positives:** - Backup/storage administrators deleting shadow copies during planned maintenance - Disk-space cleanup scripts or imaging tools that call vssadmin delete shadows **Tuning notes:** Replace index=endpoint with the index holding Sysmon data. Allowlist known backup-server hosts and service accounts by host/user. Alert at critical severity when diavol_exact_cmd=1 or when the parent is cmd.exe/powershell.exe spawned from a user-writable path. Correlate with SPL-002 service stops on the same host. ### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds - DIAVOL Ransomware - [indicator] Encrypted Files, [indicator] Note and Wallpaper Change (locked: unlock with TL Creds) - DIAVOL Ransomware - Execution Command Lines, Shadow Deletion and Self-Deletion (locked: unlock with TL Creds) - DIAVOL Ransomware - C2 Config Server Contact and SMB Share Fan-Out (locked: unlock with TL Creds) - DIAVOL Ransomware - Ransom Note and [indicator] File Creation (Sigma primary) (locked: unlock with TL Creds) - DIAVOL Ransomware - Shadow Deletion, [indicator] Execution and Self-Deletion (Sigma primary) (locked: unlock with TL Creds) - DIAVOL Ransomware - HTTP C2 URIs and 'Agent' User-Agent (Sigma primary) (locked: unlock with TL Creds) - DIAVOL Ransomware - Mass Backup/Database/Security Service Stop (locked: unlock with TL Creds) - DIAVOL Ransomware - HTTP C2 Registration and Config Fetch ([indicator]) (locked: unlock with TL Creds) Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup ## Sample indicators (3 of 14) Defanged, TLP:CLEAR. - IP address: `173.232.146[.]118` - File hash: `f4928b5365a0bd6db2e9d654a77308d7` - File hash: `ee13d59ae3601c948bd10560188447e6faaeef5336dcd605b52ee558ff2a8588` Full set of 14 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds ## Sources - [Diavol Ransomware (Chuong Dong)](https://www.chuongdong.com/reverse%20engineering/2021/12/17/DiavolRansomware/) - [FBI links the Diavol ransomware to the TrickBot gang (Security Affairs)](https://securityaffairs.com/126979/cyber-crime/fbi-links-diavol-ransomware-trickbot.html) - [FBI Flash Alert on Diavol ransomware (IC3)](https://www.ic3.gov/Media/News/2022/220120.pdf) - [Diavol ransomware appears in the threat landscape. Is it the work of the Wizard Spider gang? (Security Affairs, on Fortinet research)](https://securityaffairs.com/119637/malware/diavol-ransomware-wizard-spider-gang.html) - [New analysis of Diavol ransomware reinforces the link to TrickBot gang (Security Affairs, on IBM X-Force research)](https://securityaffairs.com/121251/malware/diavol-ransomware-trickbot-gang.html) - [TrickBot botnet found deploying new Diavol ransomware (The Hacker News)](https://thehackernews.com/2021/07/trickbot-botnet-found-deploying-new.html) - [Diavol ransomware (The Record)](https://therecord.media/trickbot-new-attacks-see-the-botnet-deploy-new-banking-module-new-ransomware/) - [Diavol ransomware linked to Trickbot botnet (ITPro)](https://itpro.com/security/ransomware/360101/diavol-ransomware-linked-to-trickbot-botnet) - [New evidence shows strong connection between Diavol ransomware and TrickBot gang (Heimdal Security)](https://heimdalsecurity.com/blog/new-evidence-shows-strong-connection-between-diavol-ransomware-and-trickbot-gang/) ## Full data The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp Canonical: https://intel.threadlinqs.com/threat/TL-2026-5286