Phoenix CryptoLocker
Phoenix CryptoLocker is a ransomware family, also referred to in reporting as Phoenix Locker, that has been linked in multiple sources to the Evil Corp cybercrime group (also tracked as GOLD DRAKE). Reporting states Evil Corp shifted to ransomware variants including WastedLocker, Hades, Phoenix CryptoLocker, and Payload.bin after U.S. sanctions in 2019, and Phoenix CryptoLocker is described as part of Evil Corp’s ransomware operations. BleepingComputer reported Phoenix CryptoLocker was used in the March 2021 attack on CNA, where it allegedly encrypted more than 15,000 devices, including systems used by remote employees connected via VPN. In that incident, encrypted files reportedly received a .phoenix extension and the malware dropped a ransom note named PHOENIX-HELP.txt. Sources cited in the content said Phoenix Locker was believed to be a new ransomware family released by Evil Corp based on code similarities, although CNA stated there was no confirmed nexus between the Phoenix threat actor and any sanctioned entity and that no U.S. government agency had confirmed such a relationship. The content also notes Phoenix Cryptolocker among ransomware variants whose proceeds were processed by the Garantex cryptocurrency exchange, according to U.S. Treasury reporting. High-confidence indicators directly mentioned in the content are the .phoenix file extension and the ransom note filename PHOENIX-HELP.txt.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The malware has been previously linked to Evil Corp, a Russian cybercrime gang active since 2007 that has been associated with the Zeus and Dridex malware families and was behind the WastedLocker, Hades, Macaw Locker, and Phoenix CryptoLocker ransomware operations.
Recent activity
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware operation attributed in the article to Evil Corp.
Ransomware variant referenced as a source of illicit funds laundered through Garantex.
Ransomware family whose operators’ proceeds were laundered through the Garantex cryptocurrency exchange, per the article.
Ransomware variant explicitly cited as generating proceeds laundered through Garantex.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.