Hades

Hades is a notable threat actor, known for its distinctive tactics and infrastructure in executing cyber attacks. The cybersecurity industry first observed Hades' operations in June 2021, with its activities marked by the use of advanced tools such as Advanced Port Scanner, MegaSync, Rclone, and Malleable C2, which have also been used in other ransomware incidents like Snatch, Pysa, Nefilim, REvil, Egregor, Darkside, and Defray. This group's unique approach includes the use of MSBuild to execute Metasploit, disguised as a ".proj" file, an uncommon technique that further distinguishes Hades from other threat actors. In one of the most significant incidents attributed to Hades, a U.S. insurance provider was forced to pay $40 million in late March 2021 to regain access to its network following a ransomware attack. The ransomware variant deployed in this instance was operated by the GOLD WINTER threat group, indicating a possible connection or collaboration between Hades and GOLD WINTER. This incident underscores the severe financial implications of Hades' operations and the sophisticated nature of their attacks. The threat actor Hades has also been linked to Sandworm, another malicious entity, through the attribution of a wiper named SwiftSlicer. This suggests that Hades may operate under multiple aliases or in conjunction with other threat actors to broaden its impact and evade detection. As the cybersecurity landscape continues to evolve, understanding and tracking the activities of threat actors like Hades remains crucial for organizations worldwide.