Inactive ransomware operator
← All groupsHades
1 victims indexed · first seen 5 years ago · last activity 5 years ago
At a glance
- Status
- inactive
- First seen
- 5 years ago
- Last activity
- 5 years ago
- Onion sites
- 1 known endpoint
- Primary sector
- Transportation Systems · 1 hits
About
References
18 linksExternal sources curated by the MISP threat-intel community.
- secureworks.com/research/threat-profiles/gold-winter
- assets.sentinelone.com/sentinellabs/sentinellabs_EvilCorp
- awakesecurity.com/blog/incident-response-hades-ransomware-gang-or-hafnium/
- blog.truesec.com/2021/05/05/are-the-notorious-cyber-criminals-evil-corp-actually-russian-spies/
- docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3
- killingthebear.jorgetesta.tech/actors/evil-corp
- symantec.broadcom.com/hubfs/The_Ransomware_Threat_September_2021.pdf
- twitter.com/inversecos/status/1381477874046169089?s=20
- accenture.com/us-en/blogs/cyber-defense/unknown-threat-group-using-hades-ransomware
- accenture.com/us-en/blogs/security/ransomware-hades
- advanced-intel.com/post/adversarial-perspective-advintel-breach-avoidance-through-monitoring-initial-vulnerabilities
- bleepingcomputer.com/news/security/evil-corp-switches-to-hades-ransomware-to-evade-sanctions/
- crowdstrike.com/blog/how-big-game-hunting-ttps-shifted-after-darkside-pipeline-attack/
- huntandhackett.com/blog/advanced-ip-scanner-the-preferred-scanner-in-the-apt-toolbox
- mandiant.com/resources/unc2165-shifts-to-evade-sanctions
- secureworks.com/blog/hades-ransomware-operators-use-distinctive-tactics-and-infrastructure
- sentinelone.com/wp-content/uploads/2022/02/S1_-SentinelLabs_SanctionsBeDamned_final_02.pdf
- ransomlook.io/group/hades
Timeline
1 monthsTop countries
Top sectors
MITRE ATT&CK
3 techniques · 3 tacticsTactics
Recent victims
Loading…
Onion infrastructure
1 known- http://ixltdyumdlthrtgx.onion
Source
Updated 5 years agoData on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.
