Skip to main content
Darkfield

Operator dossier

Vanirgroup (also tracked as vanir group) is a ransomware operator no longer publishing new disclosures. Darkfield has indexed 3 public victims claimed by this operator between July 10, 2024. Vanirgroup is an emerging ransomware operation that first appeared in July 2024, primarily motivated by financial gain through extortion activities. Due to the group's recent emergence and limited public documentation, their country of origin and potential affiliations with other cybercriminal organizations remain unknown, and it is unclear whether they operate as an independent entity or follow a Ransomware-as-a-Service model. Their attack methodology, initial access vectors, and technical capabilities have not been extensively documented by major threat intelligence firms, though their targeting pattern suggests a focus on technology sector organizations. The group has been observed compromising at least three known victims since their emergence, with their attacks concentrated within the technology industry, though specific details about high-profile incidents or ransom demands have not been publicly disclosed by CISA, FBI, or established security research organizations. Vanirgroup appears to remain active as of late 2024, though their limited operational footprint and recent emergence mean their long-term trajectory and potential for expansion remain uncertain.

Most-targeted sectors

Recent disclosures by Vanirgroup

All 3 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for Vanirgroup →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Inactive ransomware operator

← All groups

Vanirgroup

aka vanir group · 3 victims indexed · first seen 2 years ago · last activity 2 years ago

3
Victims indexed
#280 of 364 tracked operators
<1m
Active period
Jul 2024 → Jul 2024
—
Countries hit

At a glance

Status
inactive
Aliases
vanir group
First seen
2 years ago
Last activity
2 years ago
Onion sites
2 known endpoints
Primary sector
Technology · 3 hits

About

Vanirgroup is an emerging ransomware operation that first appeared in July 2024, primarily motivated by financial gain through extortion activities. Due to the group's recent emergence and limited public documentation, their country of origin and potential affiliations with other cybercriminal organizations remain unknown, and it is unclear whether they operate as an independent entity or follow a Ransomware-as-a-Service model. Their attack methodology, initial access vectors, and technical capabilities have not been extensively documented by major threat intelligence firms, though their targeting pattern suggests a focus on technology sector organizations. The group has been observed compromising at least three known victims since their emergence, with their attacks concentrated within the technology industry, though specific details about high-profile incidents or ransom demands have not been publicly disclosed by CISA, FBI, or established security research organizations. Vanirgroup appears to remain active as of late 2024, though their limited operational footprint and recent emergence mean their long-term trajectory and potential for expansion remain uncertain.

References

1 link

External sources curated by the MISP threat-intel community.

Timeline

1 months
2024-07-01T00:00:00+00:00 · 3
2024-07-01T00:00:00+00:002024-07-01T00:00:00+00:00

Top sectors

Technology
3
Technology dossier →

MITRE ATT&CK

3 techniques · 3 tactics

Tactics

Initial AccessExecutionImpact

Techniques

  • T1566Phishing
  • T1059Command and Scripting Interpreter
  • T1486Data Encrypted for Impact

Recent victims

Loading…

Onion infrastructure

2 known
  • http://6xdpj3sb5kekvq5ulym5qqmzsv6ektjgvpmajns3qrafgxtyxrhokfqd.onion
  • http://6xdpj3sb5kekvq5ulym5qqmzsv6ektjgvpmajns3qrafgxtyxrhokfqd.onion/assets/index-49d93e78.js

Source

Updated 2 years ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time Vanirgroup posts a victim.

Add Vanirgroup to your watchlist — Pro pings you within 5 minutes of any new Vanirgroup leak-site post, Telegram callout, or affiliate-rebrand inference.