MalwareUsed by 1 actor

Phoenix Locker

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

INDRIK SPIDER

A few months later, in March 2021, a new variant Phoenix Locker appeared in the wild. Our analysis suggests this is a rebranded version of Hades with little to no changes.

via sentinelone labssentinelone.com

MITRE ATT&CK

Techniques & procedures

10 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1078Valid AccountsEvidence1

the threat actors conducted reconnaissance within CNA's IT environment using legitimate tools and credentials to avoid detection

T1189Drive-by CompromiseEvidence1

the attackers first breached an employee's workstation on March 5 using a fake and malicious browser update delivered via a legitimate website

Execution

1 technique

T1059.003Windows Command ShellEvidence1

cmd /c waitfor /t 10 pause /d y & attrib -h ... & del ... & rd ...

Persistence

1 technique

T1078Valid AccountsEvidence1

the threat actors conducted reconnaissance within CNA's IT environment using legitimate tools and credentials to avoid detection

Privilege Escalation

1 technique

T1078Valid AccountsEvidence1

the threat actors conducted reconnaissance within CNA's IT environment using legitimate tools and credentials to avoid detection

Stealth

3 techniques

T1070Indicator RemovalEvidence1

On March 20 and into March 21, 2021, the Threat Actor disabled monitoring and security tools; destroyed and disabled certain CNA back-ups

T1070.004File DeletionEvidence1

From Hades onwards, we found a unique self-delete implementation including the waitfor command.

T1078Valid AccountsEvidence1

the threat actors conducted reconnaissance within CNA's IT environment using legitimate tools and credentials to avoid detection

Collection

1 technique

T1560Archive Collected DataEvidence1

the Threat Actor copied, compressed and staged unstructured data obtained from file shares found on three CNA virtual servers

Exfiltration

1 technique

T1567.002Exfiltration to Cloud StorageEvidence1

used MEGAsync, a legitimate tool, to copy some of that unstructured data from the CNA environment directly into the threat actor's cloud-based account hosted by Mega NZ Limited

Impact

2 techniques

T1486Data Encrypted for ImpactEvidence2

deployed ransomware onto certain systems within the environment... encrypted more than 15,000 systems

T1490Inhibit System RecoveryEvidence1

All ransomwares have the same implementation of Shadows copy deletion: C:\Windows\system32\vssadmin.exe Delete Shadows / All /Quiet

Other

1 technique

T1562Impair DefensesEvidence1

On March 20 and into March 21, 2021, the Threat Actor disabled monitoring and security tools

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

sentinelone labsNews

Feb 23, 2022

Sanctions Be Damned | From Dridex to Macaw, The Evolution of Evil Corp | SentinelOne

Ransomware assessed as a rebranded and newly packed Hades payload, reusing a clean Hades version with junk code added to alter signatures and improve evasion.

wikipedia cyber incidentsNews

Jan 5, 2004

List of security hacking incidents - Wikipedia

Ransomware variant (linked in reporting to Hades lineage) used to encrypt large enterprise environments (CNA cited).

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping10

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

Phoenix Locker

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

INDRIK SPIDER

A few months later, in March 2021, a new variant Phoenix Locker appeared in the wild. Our analysis suggests this is a rebranded version of Hades with little to no changes.

via sentinelone labssentinelone.com

MITRE ATT&CK

Techniques & procedures

10 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1078Valid AccountsEvidence1

the threat actors conducted reconnaissance within CNA's IT environment using legitimate tools and credentials to avoid detection

T1189Drive-by CompromiseEvidence1

the attackers first breached an employee's workstation on March 5 using a fake and malicious browser update delivered via a legitimate website

Execution

1 technique

T1059.003Windows Command ShellEvidence1

cmd /c waitfor /t 10 pause /d y & attrib -h ... & del ... & rd ...

Persistence

1 technique

T1078Valid AccountsEvidence1

the threat actors conducted reconnaissance within CNA's IT environment using legitimate tools and credentials to avoid detection

Privilege Escalation

1 technique

T1078Valid AccountsEvidence1

the threat actors conducted reconnaissance within CNA's IT environment using legitimate tools and credentials to avoid detection

Stealth

3 techniques

T1070Indicator RemovalEvidence1

On March 20 and into March 21, 2021, the Threat Actor disabled monitoring and security tools; destroyed and disabled certain CNA back-ups

T1070.004File DeletionEvidence1

From Hades onwards, we found a unique self-delete implementation including the waitfor command.

T1078Valid AccountsEvidence1

the threat actors conducted reconnaissance within CNA's IT environment using legitimate tools and credentials to avoid detection

Collection

1 technique

T1560Archive Collected DataEvidence1

the Threat Actor copied, compressed and staged unstructured data obtained from file shares found on three CNA virtual servers

Exfiltration

1 technique

T1567.002Exfiltration to Cloud StorageEvidence1

used MEGAsync, a legitimate tool, to copy some of that unstructured data from the CNA environment directly into the threat actor's cloud-based account hosted by Mega NZ Limited

Impact

2 techniques

T1486Data Encrypted for ImpactEvidence2

deployed ransomware onto certain systems within the environment... encrypted more than 15,000 systems

T1490Inhibit System RecoveryEvidence1

All ransomwares have the same implementation of Shadows copy deletion: C:\Windows\system32\vssadmin.exe Delete Shadows / All /Quiet

Other

1 technique

T1562Impair DefensesEvidence1

On March 20 and into March 21, 2021, the Threat Actor disabled monitoring and security tools

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

sentinelone labsNews

Feb 23, 2022

Sanctions Be Damned | From Dridex to Macaw, The Evolution of Evil Corp | SentinelOne

Ransomware assessed as a rebranded and newly packed Hades payload, reusing a clean Hades version with junk code added to alter signatures and improve evasion.

wikipedia cyber incidentsNews

Jan 5, 2004

List of security hacking incidents - Wikipedia

Ransomware variant (linked in reporting to Hades lineage) used to encrypt large enterprise environments (CNA cited).

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping10

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.