Specialists at F6 have discovered a new ransomware group operating under the name VantaCore that is targeting Russian small and medium-sized businesses with its own suite of malicious tools. At least four victims have already been identified, with ransom demands reaching millions of dollars.
According to F6, VantaCore may represent a new branding of the previously known pro-Ukrainian group Thor. Evidence includes a similar design of Tor-based negotiation chats and a site icon featuring the runic inscription THOR. The leak resource itself appeared no later than June 7, 2026.
The attackers employ double and triple extortion tactics. They first steal data, then destroy backups and encrypt critical information. If the company refuses to pay, the stolen materials are published, sold, or used in follow-on attacks.
Initial access is achieved by targeting weakly protected RDP and VPN services, vulnerable public-facing applications, and compromised partner credentials. Inside the network, the group moves laterally via SMB and RDP using legitimate accounts.
On compromised Windows systems, the attackers create services, install Tactical RMM, and deploy their custom backdoor VantaCoreRAT. Mass deployment of tools is handled by the proprietary loader VantaCoreLoader.
Before launching the encryptor, the criminals stop protective processes using an AV/EDR killer and then deploy the VantaCore ransomware across servers and workstations. Negotiations occur through a Tor chat whose link is provided in the ransom note.
While the attack techniques themselves are not considered particularly sophisticated by F6, the group’s fully custom toolset and well-established pressure tactics make the operation effective against its targets.
