Hades is a financially motivated ransomware group that emerged in December 2020 and is closely associated with the Russian-based cybercrime syndicate Evil Corp, also known as Indrik Spider. The group began using Hades ransomware as a successor to WastedLocker, another Evil Corp-developed ransomware, primarily to evade international sanctions imposed by the U.S. Treasury Department in December 2019. Hades operates as a private, human-operated ransomware, contrasting with the Ransomware-as-a-Service (RaaS) model, which indicates a highly engaged and hands-on approach by its operators. This group distinguishes itself by meticulously selecting high-value targets, typically large organizations with annual revenues exceeding $1 billion, to maximize financial gain. Hades is also referred to by the alias "Phoenix Locker." Unique operational characteristics include the use of customized Tor victim sites and Tox instant messaging for direct communication, diverging from centralized leak sites, a

Aliases del actor

GOLD WINTERPhoenix LockerHades LockerWildFire Locker ransomwareSolarWinds Orion API (CVE-2020-10148)SUPERNOVAse relaciona con dominiosblogs analizados por fuentes de inteligencia de seguridadAPT38ElectricFishBlueNoroffTA444ofensivas en el ámbito digitalLion Soldiers TeamPhantom TurkTurkeyincluyendo el secuestro de datosla brecha de sistemas críticos"RSA incident""Red October"referencias a dominios como wwwWingDTran Duy Linhcomo el sitio web researchcenterCobraTimberwormMAGNALLIUMElfinRefined KittenHolmiumAPT33G0064

Actores similares

NoNameransomware · 0nonamethreat-actor · 2noname057-16actor · 1name-1actor · 1name-spaceactor · 1Match Legitimate Resource Name or Locationactor · 1NoName057apt · 0[Unnamed group]apt · 0Unnamed Actorapt · 0bitlockerransomware · 0

Paises afectados

URLs nuevas detectadas en IntelTracker