Diavol Ransomware - Another Emerging Ransomware Gang?
The Diavol Ransomware is a new project, which cybersecurity researchers encountered online. This file-encryption Trojan's creators act similar to other high-profile ransomware gangs. Their threat claims to have the ability to both steal and encrypt files. However, it is important to add that none of Diavol Ransomware's samples have shown the ability to steal data. This might mean that Diavol Ransomware's creators are bluffing about stealing data, or they are planning to add the feature later on.
Diavol Ransomware Gang Makes Its First Steps
Unfortunately, while the data theft portion might be a lie for now, the file-encryption attack is no joke. It is not reversible via free decryption tools, and its victims might have a hard time restoring access to their data. The Diavol Ransomware also takes extra measures to wipe out Shadow Volume Copies and System Restore points, therefore making data recovery even more difficult. Similar actions are performed by other ransomware families like the, now defunct, DarkSide Ransomware.
After Diavol Ransomware's attack, it drops the 'README_FOR_DECRYPT.txt' ransom document. It advises the victim to download and install the TOR browser, which they can use to access the TOR-based payment page. As we already said, the note also contains a message, which tells victims that their servers are locked and the data has been stolen.
Diavol Ransomware Operators Can Orchestrate Attacks Manually
The Diavol Ransomware's creators can modify their implant's attack as soon as it begins. They can do this by submitting hardcoded commands, which allow them to perform different tasks. For example, /services allows them to point the exact Windows Services they want to stop. They can use /ext to tell the implant which file extensions to ignore. While all of these parameters have default values, the criminals appear to want to have the ability to modify them on the fly.
Once the attack is near its finish, the Diavol Ransomware drops the ransom note. It also replaces the desktop wallpaper with a black and white image saying 'For more information see README-FOR-DECRYPT.txt.' Last but not least, all files that the Diavol Ransomware locks will have their names tag with the extension '.lock64.'
Unfortunately, reversing Diavol Ransomware's encryption might be an impossible task. Victims should not consider accepting the offer to buy a decryptor for the criminals. There is no guarantee that you can trust them, and so far, their claim to have stolen files is a bluff. It is advisable to eliminate the Diavol Ransomware with the help of an antivirus tool and then experiment with alternative file recovery solutions.
