Hades is a ransomware operator no longer publishing new disclosures. Darkfield has indexed 1 public victims claimed by this operator between December 15, 2020. Hades is a ransomware group that emerged in December 2020, operating as a financially-motivated cybercriminal organization targeting critical infrastructure sectors. The group's origin and specific affiliations remain largely undocumented in public threat intelligence reporting, though their operational patterns suggest they operate independently rather than as a ransomware-as-a-service model. Limited public documentation exists regarding Hades' specific attack methodology, though like most modern ransomware operators, they likely employ common initial access vectors such as phishing, remote desktop protocol exploitation, or supply chain compromises to gain network access before deploying their encryption payloads. The group has maintained a relatively low profile compared to other ransomware families, with only one publicly documented victim in the transportation systems sector within the United States, suggesting either highly targeted operations or limited operational scope. Current intelligence indicates minimal recent activity from the Hades group, though the lack of extensive public reporting makes it difficult to definitively assess whether the group remains active, has rebranded under a different name, or has ceased operations entirely.

Recent disclosures by Hades

All 1 indexed disclosures. Click any row for the full per-victim dossier.

• Forward Air CorpTransportation Systems · United States · December 15, 2020

See every disclosure indexed for Hades →