Threat intelligence / Malware

Diavol

[Diavol](https://attack.mitre.org/software/S0659) is a ransomware variant first observed in June 2021 that is capable of prioritizing file types to encrypt based on a pre-configured list of extensions defined by the attacker. The [Diavol](https://attack.mitre.org/software/S0659) Ransomware-as-a Service (RaaS) program is managed by [Wizard Spider](https://attack.mitre.org/groups/G0102) and it has been observed being deployed by [Bazar](https://attack.mitre.org/software/S0534).(Citation: Fortinet Diavol July 2021)(Citation: FBI Flash Diavol January 2022)(Citation: DFIR Diavol Ransomware December 2021)(Citation: Microsoft Ransomware as a Service)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

Labels

malware

20 recorded

Relationships

uses

to Data Destruction

Technique

uses

to Data Encrypted for Impact

Technique

uses

to Disable or Modify Tools

Technique

uses

to File and Directory Discovery

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Inhibit System Recovery

Technique

uses

to Internal Defacement

Technique

uses

to Native API

Technique

uses

to Network Share Discovery

Technique

uses

to Obfuscated Files or Information

Technique

uses

to Process Discovery

Technique

uses

to Remote System Discovery

Technique

uses

to Service Stop

Technique

uses

to SMB/Windows Admin Shares

Technique

uses

to Steganography

Technique

uses

to System Information Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to Web Protocols

Technique

uses

from Wizard Spider

Group

6 external

References

mitre-attack

S0659

open

Diavol

—

DFIR Diavol Ransomware December 2021

https://thedfirreport.com/2021/12/13/diavol-ransomware/

open

FBI Flash Diavol January 2022

https://www.ic3.gov/CSA/2022/220120.pdf

open

Microsoft Ransomware as a Service

https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/

open

Fortinet Diavol July 2021

https://www.fortinet.com/blog/threat-research/diavol-new-ransomware-used-by-wizard-spider

open