# **Hades Malware – Ransomware by Evil Corp** 💀💻 **Hades ransomware** is a **highly targeted ransomware strain** attributed to **Evil Corp (TA505)**. It emerged in **late 2020** as a **rebranded version of WastedLocker**, likely to evade **U.S. sanctions** imposed on Evil Corp. Unlike mass-distributed ransomware, **Hades focuses on big corporations** for **multi-million-dollar ransom demands** and often includes **double extortion tactics**. --- ## **🔹 Key Facts About Hades** - **First Seen:** December 2020 - **Threat Actor:** **Evil Corp (TA505)** - **Primary Targets:** Large enterprises, **manufacturing, logistics, healthcare, retail** - **Attack Method:** Phishing, credential theft, and custom payloads - **Ransom Demand:** Typically in the **millions** of dollars - **Notable Victims:** **Forward Air (2020), European corporations (2021)** 🚨 **Hades is NOT the same as Hades APT (Chinese cyber espionage group)** – different actors! --- ## **🔹 Notable Hades Ransomware Attacks** |**Attack**|**Description**|**Target**|**Year**| |---|---|---|---| |**Forward Air Attack**|Logistics firm suffered operational disruption & extortion attempt|U.S. logistics|2020| |**Undisclosed Manufacturing Companies**|Multiple European firms targeted for multimillion-dollar ransoms|Manufacturing sector|2021| |**Healthcare Sector Attacks**|Hospitals and healthcare firms hit with double extortion|U.S. & EU healthcare|2021| 📌 **Why These Targets?** – Evil Corp focuses on high-revenue industries that **can't afford downtime**, increasing ransom payment likelihood. --- ## **🔹 Hades Malware Analysis & Tactics** ### **1️⃣ Initial Access (How It Spreads)** - **Spear-phishing emails** with **malicious attachments** - **Compromised RDP servers** (brute-force & credential stuffing) - **Fake software installers** - **Exploiting vulnerabilities in VPNs, remote access tools** ### **2️⃣ Execution & Lateral Movement** - Uses **PowerShell scripts & Cobalt Strike** for execution - Deploys **Mimikatz** to steal credentials - **Disables security tools (AV, EDR)** - Moves laterally through **SMB, PsExec, RDP abuse** ### **3️⃣ Data Theft & Ransomware Deployment** - **Exfiltrates sensitive data** before encryption (double extortion) - Encrypts local & network files using **AES-256 & RSA-2048** - Drops **ransom note** instructing victims to contact attackers via **Tor-based chat** ### **4️⃣ Impact & Extortion** - Encrypts systems, making recovery impossible without payment - Threatens to **leak stolen data** on dark web leak sites - Demands **millions in Bitcoin** for decryption --- ## **🔹 Hades vs Other Evil Corp Ransomware** |**Feature**|**WastedLocker**|**Hades**|**LockBit 3.0 (Affiliate Use)**| |---|---|---|---| |**Actor**|Evil Corp|Evil Corp|Mixed Groups (Possibly Evil Corp)| |**Targeting**|U.S. Corporations|U.S. & EU Companies|Global| |**Ransom Method**|High-Value Targets|High-Value Targets|Mass Ransomware-as-a-Service (RaaS)| |**Sanctions Evasion?**|❌ No|✅ Yes|✅ Yes| 🚨 **Why the rebrand?** – After the **2019 U.S. Treasury sanctions** on Evil Corp, **companies were legally restricted from paying them**. Hades was likely a way to **bypass these restrictions**. --- ## **🔹 Indicators of Compromise (IOCs)** ### **File Hashes (SHA-256)** [Samples vary – real IOCs should be gathered from threat intelligence feeds] Network Indicators C2 Domains: hadesransom[.]top decryptyourdata[.]com Tor Communication Links YARA Rule Example for Hades Ransomware rule Hades_Ransomware { meta: description = "Detects Hades ransomware samples" author = "Threat Research" date = "2021-01-15" strings: $a = "Hades Ransomware" wide ascii $b = "AES-256 encryption" wide ascii $c = "decryptyourdata" ascii condition: any of them } 🔹 How to Defend Against Hades ✅ Block Macros & Disable PowerShell Execution ✅ Enforce MFA on RDP & VPN access ✅ Monitor for abnormal SMB, RDP, and PsExec usage ✅ Use EDR solutions to detect Cobalt Strike & Mimikatz activity ✅ Regularly back up data & keep backups offline 🔹 Current Status: Is Hades Still Active? 🔥 Yes, but under new branding! Since late 2021, Hades has faded from the spotlight, and Evil Corp is suspected of using LockBit & Black Basta ransomware to avoid U.S. sanctions.