A ransomware group believed to be linked to pro-Ukrainian hackers is targeting Russian organizations with custom malware and demanding multimillion-dollar payments, according to new research.

The group, which calls itself VantaCore, has targeted at least seven known victims, Russian cybersecurity firm F6 said in a report published this week. Researchers first detected its activity in August, although the group's data-leak website appears to have been created in early June.

Researchers said they believe VantaCore is a rebrand of Thor, a pro-Ukrainian hacking group that was among the more active ransomware operations targeting Russia last year. F6 attributed at least 12 attacks to Thor in 2025. Its operations have combined financial extortion with destructive or politically motivated activity, according to the company.

VantaCore, however, appears primarily focused on making money, according to F6, with ransom demands reaching millions of dollars.

The group operates as a ransomware-as-a-service operation, a business model in which ransomware developers provide malware and infrastructure to affiliates who carry out attacks. VantaCore communicates with victims through a Tor-based chat service and maintains a leak site where stolen information can be published.

The hackers use several common methods to break into corporate networks, including exploiting poorly secured VPNs and other remote-access tools, flaws in internet-facing applications and login credentials stolen from business partners.