A new ransomware operation calling itself VantaCore has claimed at least seven victims among Russian organizations, demanding multimillion-dollar payouts, according to research published this week by the Russian cybersecurity firm F6. Researchers believe VantaCore is a rebranding of Thor, a pro-Ukrainian hacking group that carried out at least 12 attacks against Russian targets in 2025.
What distinguishes VantaCore from many ransomware operations is its reliance on entirely custom-built tools. The group’s proprietary ransomware, also named VantaCore, can encrypt data across both servers and employee workstations simultaneously. A loader called VantaCoreLoader spreads the ransomware through compromised networks. VantaCoreRAT, a custom backdoor, collects system information, moves files, and remotely executes commands. A fourth tool, SnowKiller, is designed specifically to disable antivirus and endpoint security products before encryption begins. The group gets initial access primarily by exploiting poorly secured VPNs and remote-access services, unpatched internet-facing applications, and credentials stolen from business partners.
Unlike earlier pro-Ukrainian hacking groups that relied on leaked ransomware variants like LockBit 3 Black or Babuk — software with Russian origins that some ideologically motivated actors have been unwilling to use — VantaCore built its own stack. F6 notes a broader pattern among pro-Ukrainian groups of moving away from shared or Russian-derived ransomware and developing proprietary tooling, partly because weaknesses in those older tools have been publicized over time. Beyond financial extortion, stolen data from Russian companies can also be published or sold online to support further operations targeting Russian entities.