State-backedUkraine
VantaCore
Also known as Thor
0mentions, 7 days
1mentions, 30 days
Oct 15, 2026last mentioned
VantaCore is a ransomware group believed to be a rebrand of Thor, targeting Russian organizations with custom-built malware and multimillion-dollar ransom demands. F6 says the group has attacked at least seven victims, uses a ransomware-as-a-service model, and reflects a broader shift among pro-Ukrainian hackers toward in-house tooling instead of LockBit 3 Black and Babuk.
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
Recent activity
- The Q3 Vulnerability Pulse: Discovery ≠ Exploitationblog · Oct 15, 2026
References
- https://www.hendryadrian.com/new-pro-ukraine-hacker-group-targets-russian-companies-with-custom-ransomware/
- https://www.f6.ru/blog/vantacore/?utm_referrer=https%3A%2F%2Fwww.f6.ru%2Fblog%2Fvantacore%2F
- https://www.ransomlook.io/group/thor
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.