Hades

Hades is a significant threat actor that has been active in the cybersecurity landscape, particularly associated with ransomware attacks. The group uses distinctive tactics and infrastructure, as noted by CTU researchers in June 2021. Hades ransomware operators have been observed using Advanced Port Scanner, a tool previously seen in Snatch, Pysa, and other ransomware incidents. They also employ MegaSync, a tool used in Nefilim, Pysa, and other operations, along with Malleable C2, which has been encountered in Darkside, Defray, and other incidents. In late March 2021, Hades orchestrated a major attack on a U.S. insurance provider, leading to a substantial ransom payment of $40 million for network access restoration. This specific attack involved a Hades ransomware variant operated by the GOLD WINTER threat group. Some members of this group are known to continually adapt their methods and have gone on to develop further malware and ransomware strains such as WastedLocker, PhoenixLocker, PayloadBIN, and Macaw. Interestingly, the group has also been linked to the development of a wiper named SwiftSlicer, attributed to Sandworm, another alias for Hades. The group's activities have had a global impact, with victims hailing from all corners of the world. Their actions and the subsequent discussions about them have sparked lively online conversations among cybersecurity professionals worldwide, highlighting the group's influence and the importance of ongoing vigilance against their evolving tactics.