VanirGroup is a ransomware group formed in mid-2024 by former affiliates of Karakurt, LockBit, and Knight.
VanirGroup is an Eastern European ransomware group that emerged in mid-2024, consisting of former affiliates from Karakurt, LockBit, and Knight operations. They target various sectors using ransomware for data encryption and theft. Key TTPs include double extortion via a data leak site, alongside ransomware variants influenced by the LockBit legacy. Defenders should focus on intrusion monitoring, network segmentation, and robust backup recovery processes to respond to ransomware incidents.
VanirGroup is an Eastern European ransomware group composed of former affiliates from Karakurt, LockBit, and Knight ransomware that emerged in mid-2024, before German law enforcement (Karlsruhe Public Prosecutor's Office) seized its leak site.
VanirGroup is composed of former affiliates from Karakurt, LockBit, and Knight ransomware operations.
The Karlsruhe Public Prosecutor's Office in Germany seized VanirGroup's leak site.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.