Diavol
Software · ATTACK:enterprise:S0659
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0659",
"title": "Diavol",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0659",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--4e9bdf9a-4957-47f6-87b3-c76898d3f623",
"external_id": "S0659",
"domain": "enterprise",
"created": "2021-11-12T19:02:16.381Z",
"modified": "2024-11-17T20:10:33.591Z",
"version": "2.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Diavol"
},
{
"source_name": "DFIR Diavol Ransomware December 2021",
"url": "https://thedfirreport.com/2021/12/13/diavol-ransomware/"
},
{
"source_name": "FBI Flash Diavol January 2022",
"url": "https://www.ic3.gov/CSA/2022/220120.pdf"
},
{
"source_name": "Microsoft Ransomware as a Service",
"url": "https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/"
},
{
"source_name": "Fortinet Diavol July 2021",
"url": "https://www.fortinet.com/blog/threat-research/diavol-new-ransomware-used-by-wizard-spider"
}
]
}Explicit source assertions (20)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0659 → uses → ATTACK:enterprise:T1485
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--063b76d3-a002-44a1-aafa-d626008ee786
Fortinet Diavol July 2021ATTACK:enterprise:S0659 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--14e02371-ba11-459d-9662-188e85d3cf7c
Fortinet Diavol July 2021ATTACK:enterprise:S0659 → uses → ATTACK:enterprise:T1486
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1e549632-405c-49fc-8594-3666ad22c681
Fortinet Diavol July 2021ATTACK:enterprise:S0659 → uses → ATTACK:enterprise:T1489
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2035eee7-c1c3-4039-9fc0-af85b21a5e3f
Fortinet Diavol July 2021ATTACK:enterprise:S0659 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--22a1c738-6d0f-4abd-b00c-ee0b37ba1db6
Fortinet Diavol July 2021ATTACK:enterprise:S0659 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2f3389a4-e0a6-4dc5-b5ff-38fd185e2821
Fortinet Diavol July 2021ATTACK:enterprise:S0659 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--31667cdd-1ac5-46f5-8dbd-9ebaf09f00a9
Fortinet Diavol July 2021ATTACK:enterprise:S0659 → uses → ATTACK:enterprise:T1135
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--39aeaed2-f7ca-4fb6-8268-13e8e995461e
Fortinet Diavol July 2021ATTACK:enterprise:S0659 → uses → ATTACK:enterprise:T1685
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4ad6ce8b-4554-4b4f-b6d7-a049d2f83155
Fortinet Diavol July 2021ATTACK:enterprise:S0659 → uses → ATTACK:enterprise:T1021.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4dd44f72-a08e-4dac-9875-98690508ed08
Fortinet Diavol July 2021ATTACK:enterprise:S0659 → uses → ATTACK:enterprise:T1491.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5410e6d1-1ec5-4cb9-9647-378f2266f774
Fortinet Diavol July 2021ATTACK:enterprise:S0659 → uses → ATTACK:enterprise:T1027.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--65838f5f-0cc3-4e33-953a-11f1e5e7a20e
Fortinet Diavol July 2021ATTACK:enterprise:S0659 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a63fc51d-0bec-49e8-8258-13ed157efbeb
Fortinet Diavol July 2021ATTACK:enterprise:S0659 → uses → ATTACK:enterprise:T1027
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ac6100b4-8a41-4353-8cbf-46e596d8d212
Fortinet Diavol July 2021ATTACK:enterprise:S0659 → uses → ATTACK:enterprise:T1018
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--afe9286d-076f-49af-90f3-11ebbe82ad40
Fortinet Diavol July 2021ATTACK:enterprise:S0659 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b4ff0d25-3efb-4deb-898e-f25e18d4ae90
Fortinet Diavol July 2021ATTACK:enterprise:S0659 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ccd4c695-2458-4eb0-ad9c-a19d411f7627
Fortinet Diavol July 2021ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:S0659
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cf32eab2-753c-4303-9667-54bc8c987a13
Microsoft Ransomware as a ServiceATTACK:enterprise:S0659 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d55ab651-738b-4bbc-9438-57fc76be8f52
Fortinet Diavol July 2021ATTACK:enterprise:S0659 → uses → ATTACK:enterprise:T1490
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ec0ea37c-cb59-4138-ac0a-ad401b37d5fe
Fortinet Diavol July 2021