Loading malware…
Hades is a Windows ransomware family first observed in December 2020 and associated with Evil Corp, also known as INDRIK SPIDER. It is a 64-bit variant of WastedLocker with substantial code and functional overlap, additional obfuscation, and minor feature changes. Its emergence formed part of Evil Corp’s repeated ransomware rebranding following U.S. Treasury sanctions in 2019, intended to obscure attribution and circumvent restrictions affecting ransom payments.
Hades retains WastedLocker’s multistage installation and persistence mechanisms, file and directory enumeration, and encryption functionality. The families share RSA routines used to protect AES encryption keys. Hades also deletes volume shadow copies to inhibit recovery and incorporates self-deletion behavior. Ransom notes direct victims to individualized Tor negotiation pages and provide contact through Tox. Human-operated Hades campaigns target enterprise networks; the December 2020 attack on freight and logistics company Forward Air disrupted operational and information technology systems. Operators have used MEGA synchronization tooling for data exfiltration in support of extortion. SocGholish has also delivered Hades through infection chains associated with compromised websites and fake browser-update lures.
The Hades name is additionally used for a Go-based Windows and Linux backdoor and for malicious software-package campaigns; their characteristics should not be conflated with this ransomware family.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
5 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Some of the ransomware names used are WastedLocker, Hades, and Phoenix.
there were several reports that the threat actor behind Wasted Locker were no longer distributing this ransomware but had instead switched to another ransomware called Hades.
The financially motivated group TeamPCP was linked to some of the most significant activity, including the self-propagating “Mini Shai-Hulud” worm, which continued to spawn derivative campaigns, dubbed Miasma and Hades, after its source code was published to GitHub in May.
Once executed via any of the three delivery branches, the Hades-family payload aggressively harvests secrets from developer workstations and CI/CD environments.
"With Hades attacks, GOLD DRAKE made extensive use of Cobalt Strike..."
79 distinct techniques documented for this family, organized by ATT&CK tactic.
The information is then uploaded to a public GitHub repository with description "Alright Lets See If This Works."
« T1585.001 — Establish Accounts: Social Media Accounts (Resource Development) »
« T1586.001 — Compromise Accounts: Social Media Accounts (Resource Development) »
Some of the other packages include a set of AI and Model Context Protocol (MCP)-themed packages and typosquat-style packages such as rsquests, tlask, and rlask that impersonate requests and flask, and a langchain-core-mcp.
Предположительно, хакеры использовали утекшие учетные данные и сумели получить токен npm.
...sent self-replicating worms...
SocGholish is an advanced delivery framework used in drive-by-download and watering hole attacks.
T1190 — Exploit Public-Facing Application (Initial Access)
NCC Group’s analysts describe a marked escalation in attacks against the software development ecosystem during Q2, with campaigns hitting GitHub Actions, npm, PyPI, Docker Hub, Open VSX and the Visual Studio Code Marketplace.
The report warns that these campaigns exploit “transitive trust” in software supply chains, turning maintainer accounts, CI/CD tokens and cloud credentials into high-value targets, with effects that can cascade well beyond the organisation initially compromised.
Attackers published malicious or backdoored npm package versions following theft or abuse of publishing credentials; worms subsequently propagated by publishing malicious versions of other reachable packages.
Persistance : Registry Run Key + tâche planifiée (Windows), cron job (Linux)
« T1059 — Command and Scripting Interpreter (Execution) »
Once executed, the HTA or JS file acts as a preliminary loader, collecting system information and performing anti-analysis checks before using cmd.exe or Powershell.exe to connect to a command and control server to retrieve any secondary payloads for deployment.
Once executed, the HTA or JS file acts as a preliminary loader, collecting system information and performing anti-analysis checks before using cmd.exe or Powershell.exe to connect to a command and control server to retrieve any secondary payloads for deployment.
The malicious npm packages ... incorporates a binding.gyp file to execute arbitrary code during installation, resulting in the launch of a JavaScript loader that downloads and installs the Bun runtime if not present, and then initiate the stealer payload.
GlassFish : scripts Node.js déployant des WAR shells ( shell.war , itcenter-docs.war )
Native extension import trigger — Malicious code is embedded directly inside compiled .abi3.so extensions. The Python source appears clean, but the extension executes _index.js the moment Python loads the module via dlopen()
Some of the package versions in the latest wave also use this delivery pattern, while others were found to embed the malicious execution path inside a compiled .abi.so extension. In these cases, the JavaScript payload is executed when Python imports the package and loads the extension; this is more difficult to detect, as the malicious component is not apparent when scanning the package’s .py files.
Purpose-built scripts target MOF Hadoop infrastructure with a HiveServer2 client using hardcoded credentials and a malicious Hive UDF issuing commands and returning output over WebHDFS
These attacks uses sophisticated social engineering lures to convince target user to download and run malware, including ransomware and RATs.
When a user interacts with this content, a ZIP archive containing a heavily obsfuscated HTA or JS file is downloaded to their system. The file is then executed when the user opens the ZIP archive.
The first wave of 37 malicious wheel artifacts used a .pth startup hook (*-setup.pth) to download Bun and execute the bundled JavaScript payload (_index.js) at every Python startup, similar to an npm install hook.
The langchain-core-mcp variant returns to a .pth startup hook, but changes the payload discovery logic by searching across sys.path, creating a loader and payload split that could evade detection rules expecting _index.js to be inside the same wheel.
The first branch is the .pth startup-hook pattern. A malicious wheel contains a *-setup.pth file and a bundled _index.js. The .pth hook runs during Python startup, downloads Bun if needed, and runs the JavaScript payload.
Persistance : Registry Run Key + tâche planifiée (Windows), cron job (Linux)
Предположительно, хакеры использовали утекшие учетные данные и сумели получить токен npm.
GitHub dead-drop exfiltration by creating repositories under a usable GitHub token and committing encrypted result files under results/ .
From July 9 to 13, Hunt.io's platform Attack Capture identified three simultaneous open directories hosted in Hong Kong, which contained exploit code for multiple CVEs, Web shells, suo5 HTTP tunnels, and custom scripts.
Install a background service named "gh-token-monitor"
...or a LaunchAgent on macOS...
It sets itself up as a systemd service on Linux...
"When PyPI tokens were discovered in infected environments, it jumped ecosystems via .pth injection" and later used ".pth startup execution."
Persistance : Registry Run Key + tâche planifiée (Windows), cron job (Linux)
npm, PyPI, RubyGems, JFrog/Artifactory, GitHub Actions, and AI-tool persistence logic. gh-token-monitor dead-man switch behavior. GitHub Actions secret-dump workflow logic using VARIABLE_STORE and format-results.txt .
The first branch is the .pth startup-hook pattern. A malicious wheel contains a *-setup.pth file and a bundled _index.js. The .pth hook runs during Python startup, downloads Bun if needed, and runs the JavaScript payload.
Persistance : Registry Run Key + tâche planifiée (Windows), cron job (Linux)
Windows and Linux versions shared the same codebase and supported encrypted command-and-control communications... and, on Windows, process hollowing and screenshot capture.
Exécution en mémoire : Reflective PE loading via process hollowing dans svchost.exe (Windows)
the attacker infrastructure had extensive post-exploitation tooling, such as the aforementioned Web shells as well as staged privilege-escalation exploit code targeting both Linux and Windows.
Предположительно, хакеры использовали утекшие учетные данные и сумели получить токен npm.
Install a background service named "gh-token-monitor"
...or a LaunchAgent on macOS...
It sets itself up as a systemd service on Linux...
"When PyPI tokens were discovered in infected environments, it jumped ecosystems via .pth injection" and later used ".pth startup execution."
Persistance : Registry Run Key + tâche planifiée (Windows), cron job (Linux)
Hades ransomware is a 64-bit compiled variant of WastedLocker upgraded with supplementary code obfuscation and a few minor feature changes.
the malware queries GitHub commits for the keyword "TheBeautifulSnadsOfTime" to extract a Base64-encoded string containing a JavaScript payload. It also polls GitHub for commits matching the keyword "firedalazer" so as to fetch a Python-based dropper and execute it.
Active credential-stealing campaigns, such as Mini Shai-Hulud, Miasma, and Hades, embedding fake headers specifically engineered to fool AI-assisted review tools into marking code as benign.
Les binaires sont nommés d’après des processus légitimes : ctfmon , csrss , kworker , multipathd , accounts-daemon
Windows and Linux versions shared the same codebase and supported encrypted command-and-control communications... and, on Windows, process hollowing and screenshot capture.
Exécution en mémoire : Reflective PE loading via process hollowing dans svchost.exe (Windows)
From Hades onwards, we found a unique self-delete implementation including the waitfor command.
Предположительно, хакеры использовали утекшие учетные данные и сумели получить токен npm.
Once executed, the HTA or JS file acts as a preliminary loader, collecting system information and performing anti-analysis checks...
The payload, in turn, downloads and runs Bun from GitHub and runs the stealer, but not before checking if the system corresponds to the Russian locale.
The first wave of 37 malicious wheel artifacts used a .pth startup hook (*-setup.pth) to download Bun and execute the bundled JavaScript payload (_index.js) at every Python startup, similar to an npm install hook.
The langchain-core-mcp variant returns to a .pth startup hook, but changes the payload discovery logic by searching across sys.path, creating a loader and payload split that could evade detection rules expecting _index.js to be inside the same wheel.
its core capabilities included interactive remote shell access, persistence tasks, in-memory execution, file transferring, and SOCKS proxying
The comment contains fake instructions to an LLM... designed to trigger LLM safety refusals and disrupt AI-assisted malware triage before the scanner reaches the obfuscated Hades payload
The implant verified the signature against an embedded public key and then retrieved the referenced URL.
npm, PyPI, RubyGems, JFrog/Artifactory, GitHub Actions, and AI-tool persistence logic. gh-token-monitor dead-man switch behavior. GitHub Actions secret-dump workflow logic using VARIABLE_STORE and format-results.txt .
« Ironwood — Contournement anti-bot pour fifa.com (DataDome, Akamai) » ; « Palewater — Contournement anti-bot pour fifa.com » ; « Hades — Création de comptes ... avec gestion Akamai ».
Credential Access Steal Application Access Token T1528 GitHub/npm/PyPI/RubyGems/Azure/GCP/Anthropic tokens & OIDC exchange
the payload begins collecting credentials stored across files, environment variables, shell history, GitHub CLI tokens, cloud access keys, and CI/CD pipeline secrets.
Credential Access Credentials in Files T1552.001 ~/.aws , ~/.npmrc , ~/.pypirc , Vault token files, wallets
It retains the familiar behavior: Broad credential collection from files, environment variables, shell history, GitHub CLI tokens, cloud credentials, package-manager tokens, and CI/CD environments.
It retains the familiar behavior: Broad credential collection from files, environment variables, shell history, GitHub CLI tokens, cloud credentials, package-manager tokens, and CI/CD environments.
npm, PyPI, RubyGems, JFrog/Artifactory, GitHub Actions, and AI-tool persistence logic. gh-token-monitor dead-man switch behavior. GitHub Actions secret-dump workflow logic using VARIABLE_STORE and format-results.txt .
The report warns that these campaigns exploit “transitive trust” in software supply chains, turning maintainer accounts, CI/CD tokens and cloud credentials into high-value targets
...used techniques that scanned and read Linux process memory.
Once executed, the HTA or JS file acts as a preliminary loader, collecting system information and performing anti-analysis checks...
Hades ransomware shares the majority of its functionality with WastedLocker; the ISFB-inspired static configuration, multi-staged persistence/installation process, file/directory enumeration, and encryption functionality are largely unchanged.
Once executed, the HTA or JS file acts as a preliminary loader, collecting system information and performing anti-analysis checks...
The payload, in turn, downloads and runs Bun from GitHub and runs the stealer, but not before checking if the system corresponds to the Russian locale.
These libraries tend to show up close to cloud infrastructure, event pipelines, and CI/CD systems, exactly the places where npm installation can run with access to AWS credentials, GitHub tokens, npm publishing credentials, and application secrets.
The comment contains fake instructions to an LLM... designed to trigger LLM safety refusals and disrupt AI-assisted malware triage before the scanner reaches the obfuscated Hades payload
GlassFish : scripts Node.js déployant des WAR shells ( shell.war , itcenter-docs.war )
The Register has been covering the story of the Shai-Hulud JavaScript worm for months. We introduced this self-propagating worm in September.
...sent self-replicating worms...
The attackers deployed the previously unreported Hades Go-based implant, webshells, HTTP tunnels, and staged exploits for CVE-2021-4034 (PwnKit), CVE-2021-3156 (sudo), and CVE-2017-7269 (IIS WebDAV) to enable persistent access and expand compromise.
SSH lateral movement using ai_setup.sh and ai_init.js .
It self‑propagates by committing a malicious GitHub Actions workflow disguised as .github/workflows/codeql.yml ... into the victim’s repositories, then pushes and polls the workflow run.
Windows and Linux versions shared the same codebase and supported encrypted command-and-control communications... and, on Windows, process hollowing and screenshot capture.
The malware ... drops a workflow named "Run Copilot" to capture CI/CD environment secrets from the runner memory.
abusing legitimate platforms like GitHub and Hugging Face as C2 servers, and uploading stolen credentials directly into GitHub repositories, blending malicious traffic with the noise of normal developer activity.
Communication C2 : HTTPS avec URI imitant des assets statiques ( /assets/app.min.js , /assets/vendor.js , /assets/main.js )
The attackers deployed the previously unreported Hades Go-based implant, webshells, HTTP tunnels, and staged exploits for CVE-2021-4034 (PwnKit), CVE-2021-3156 (sudo), and CVE-2017-7269 (IIS WebDAV) to enable persistent access and expand compromise.
its core capabilities included interactive remote shell access, persistence tasks, in-memory execution, file transferring, and SOCKS proxying — a technique that turns a compromised machine into a relay point for network traffic.
The ransom notes contain a URL that directs the victims to a Tor site with info about the attack and a Tox messenger address they can use to contact Evil Corp's operators.
The token relay marker has also witnessed a change in the latest iteration ... the current artifact uses "RevokeAndItGoesKaboom," a string that has been used as GitHub dead drop resolver ...
containing a multi-stage dropper with an infostealer logic
its core capabilities included interactive remote shell access, persistence tasks, in-memory execution, file transferring, and SOCKS proxying
The malware appears to function as a custom backdoor designed to maintain persistent access to compromised systems after an initial breach. Hunt.io said it found both Windows and Linux versions capable of remotely executing commands and transferring files.
MEGA and MegaSync can be used for data exfiltration — a vital step for recent ransomware campaigns that wield the double extortion technique...
identifying StepSecurity domains and sandboxes and falling back to DNS-based exfiltration when conventional channels are blocked.
They did, though, share a Twitter account whose name indicates they will use it to leak files stolen during attacks.
First, the malware uploads the stolen credentials and API keys to GitHub using the string “Alright Lets See If This Works”
Install a background service named "gh-token-monitor" that acts as a wiper by removing all data ("rm -rf ~/; rm -rf ~/Documents") if the stolen GitHub token is revoked by the developer.
Forward Air suffered a ransomware attack by a new ransomware gang that has impacted the company's business operations. | On December 15, 2020, Forward Air Corporation ... detected a ransomware incident impacting its operational and information technology systems, which has caused service delays for many of its customers.
All ransomwares have the same implementation of Shadows copy deletion: C:\Windows\system32\vssadmin.exe Delete Shadows / All /Quiet
48 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
54 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.