Loading malware…
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
A few months later, in March 2021, a new variant Phoenix Locker appeared in the wild. Our analysis suggests this is a rebranded version of Hades with little to no changes.
10 distinct techniques documented for this family, organized by ATT&CK tactic.
the threat actors conducted reconnaissance within CNA's IT environment using legitimate tools and credentials to avoid detection
the attackers first breached an employee's workstation on March 5 using a fake and malicious browser update delivered via a legitimate website
cmd /c waitfor /t 10 pause /d y & attrib -h ... & del ... & rd ...
the threat actors conducted reconnaissance within CNA's IT environment using legitimate tools and credentials to avoid detection
the threat actors conducted reconnaissance within CNA's IT environment using legitimate tools and credentials to avoid detection
On March 20 and into March 21, 2021, the Threat Actor disabled monitoring and security tools; destroyed and disabled certain CNA back-ups
From Hades onwards, we found a unique self-delete implementation including the waitfor command.
the threat actors conducted reconnaissance within CNA's IT environment using legitimate tools and credentials to avoid detection
On March 20 and into March 21, 2021, the Threat Actor disabled monitoring and security tools
the Threat Actor copied, compressed and staged unstructured data obtained from file shares found on three CNA virtual servers
used MEGAsync, a legitimate tool, to copy some of that unstructured data from the CNA environment directly into the threat actor's cloud-based account hosted by Mega NZ Limited
deployed ransomware onto certain systems within the environment... encrypted more than 15,000 systems
All ransomwares have the same implementation of Shadows copy deletion: C:\Windows\system32\vssadmin.exe Delete Shadows / All /Quiet
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.