VantaCore Built Its Own Ransomware Stack — Then Started Hunting Russian Networks

• The Mess: A new ransomware operation calling itself VantaCore has already hit at least seven Russian organizations and is demanding multimillion-dollar ransoms. Instead of recycling someone else’s locker, the group built its own ransomware, loader, RAT and security-killing tool.

F6 researchers first spotted VantaCore activity in August 2026. The group’s leak site appeared earlier, no later than June 7, suggesting the operators prepared the infrastructure before launching the attacks.

F6 believes VantaCore is a rebrand of Thor, a pro-Ukrainian ransomware group that was linked to at least 12 attacks in 2025.

That attribution is not proven.

What is much easier to prove is the malware.

VantaCore operates an entire custom toolkit:

VantaCore ransomware encrypts files on servers and employee workstations.

VantaCoreLoader distributes the ransomware and other payloads across compromised networks.

VantaCoreRAT provides remote access, system reconnaissance, file transfer and command execution.

And then there is SnowKiller.

This is the part defenders should care about.

SnowKiller is designed to disable security software and uses the Bring Your Own Vulnerable Driver (BYOVD) technique. Instead of trying to defeat an EDR product directly, the attackers abuse a vulnerable signed driver to gain kernel-level capabilities and interfere with security controls.

Once endpoint protection is weakened, the rest of the attack becomes considerably easier.

VantaCore’s initial access methods are not particularly exotic. F6 observed the group targeting poorly secured VPN and remote-access services, exploiting vulnerabilities in Internet-facing applications and using credentials stolen from business partners. Researchers describe the group’s techniques as effective but neither sophisticated nor innovative.

The attack becomes more interesting after the first foothold.

The operators use legitimate credentials to move through the network over SMB and RDP. They perform reconnaissance with native Windows utilities such as ping, netsh, quser, qwinsta and net user, mixed with their own tools.

Persistence can come through newly created Windows services.

For remote administration, the attackers also abuse Tactical RMM, a legitimate remote-management product. That gives defenders another familiar problem: malicious activity can hide behind software that is perfectly legitimate on its own.

VantaCoreRAT adds another layer of control. The backdoor is written in Go and provides system information gathering, file movement and remote command execution.

The operators also clean up after themselves.

F6 observed attempts to delete tools and logs, clear Windows event logs using PowerShell and wevtutil, and disable security products. This makes post-incident reconstruction harder and reduces the amount of evidence left behind.

Then comes the destructive phase.

The attackers don’t just encrypt backups.

According to F6’s technical analysis, VantaCore operators have used Bootice to overwrite RAID arrays with arbitrary data, effectively destroying recovery infrastructure before launching the ransomware.

The custom encryptor itself is not a simple proof-of-concept.

F6 found that VantaCore ransomware is written in C++ and uses ChaCha20 together with X25519 for file encryption. The malware accepts a hardcoded password through the command line.

The loader handles mass deployment across the compromised network, including propagation through administrative shares.

That architecture gives the operators a complete attack chain:

break into the network → establish access → move laterally → disable security → destroy recovery options → deploy the locker → steal data → demand money.

And the group doesn’t stop at encryption.

VantaCore operates a Tor-based negotiation service and a leak site, making the operation a ransomware-as-a-service business built around double and potentially triple extortion.

Victims can therefore face three separate pressures: encrypted systems, stolen data and the threat of publication or resale.

F6 says ransom demands have reached millions of dollars.

The emergence of VantaCore also fits a broader shift among pro-Ukrainian ransomware groups.

Earlier operations increasingly relied on leaked or repurposed families such as LockBit 3 Black and Babuk. F6 says groups are now moving toward custom-built ransomware, partly because weaknesses in older ransomware families have become well known and partly because some politically motivated operators are unwilling to rely on malware with Russian origins.

That makes VantaCore interesting for reasons beyond its current victim count.

The group doesn’t need a groundbreaking exploit.

It needs one badly protected VPN, one vulnerable Internet-facing application or one compromised partner credential.

After that, its own toolchain does the rest.

• The Damage: VantaCore combines custom ransomware, a remote-access backdoor, network propagation and a BYOVD-based security killer, giving attackers a complete path from one stolen credential to encrypted and potentially unrecoverable corporate infrastructure.
• The Fix: Harden Internet-facing VPN and remote-access systems, enforce MFA, remove unnecessary administrative access, monitor for unexpected Tactical RMM deployments and investigate attempts to load vulnerable drivers or disable security products.

Bugstoday Opinion

The scary part about VantaCore isn’t the encryption algorithm.

It’s the assembly line.

Someone gets through the VPN.

VantaCoreLoader spreads.

VantaCoreRAT opens the doors.

SnowKiller kills the guards.

Bootice wrecks the backups.

Then the encryptor arrives.

None of those steps individually requires genius.

Together, they create a ransomware operation that can walk through a badly defended Windows network with its own toolkit instead of depending on whatever malware happens to be available on Telegram.

And that is where ransomware keeps heading: less borrowed malware, more purpose-built infrastructure.

Today’s Bugs. Tomorrow’s Breaches.

Technical Sources

• F6 — Ragnarök: Investigation of VantaCore Ransomware Attacks
• The Record — New Pro-Ukraine Hacker Group Targets Russian Companies With Custom Ransomware
• F6 Laboratory of Digital Forensics and Malware Research
• MITRE ATT&CK — Bring Your Own Vulnerable Driver (BYOVD)