hades

Executive Summary

HadesLocker, an updated ransomware variant of WildFire Locker, targets systems for financial gain through encryption and extortion. It appends .~HL[5_random_characters] to files and demands ransoms for decryption keys. The threat actor operates with moderate sophistication, primarily targeting various sectors for organizational profit.

Goals & Targeting

The primary motivation is financial gain, targeting various sectors and countries indiscriminately due to the broad demand for ransoms across industries. Potential victims include healthcare, education, and businesses where downtime can be costly.

HadesLocker is a sophisticated ransomware variant known for its use of AES encryption to lock data. It replaces the original WildFire Locker by encrypting files and appending a specific extension to them. The ransomware's operations typically involve infiltrating systems through phishing campaigns or exploit kits, maximizing potential financial gain. First detected in 2020, HadesLocker has shown persistent activity with limited but impactful attacks.

Key Capabilities

• Ransomware deployment via phishing or exploit kits
• AES encryption of victim files
• Threats of data deletion if demands are not met

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Campaigns typically involve rapid encryption and immediate demands. Known for targeting single victims to date, but potential broader campaigns are possible. They may use dark web forums for shaming victims who refuse to pay.

IOC Patterns

• Spear-phishing emails with malicious links
• .~HL[5_random_characters] file extensions
• File name changes during encryption

Recommended Actions

• Patch systems regularly, monitor network traffic for unusual activities, train users on spotting phishing attempts

Suggested Tags