Evil Corp Rebranded Ransomware to Evade Sanctions
Threat Actor Intelligence · 13 sources · Updated 3mo ago · First seen Feb 23, 2022
The Russia-linked Evil Corp cybercrime group repeatedly renamed and modified its ransomware after U.S. Treasury sanctions tied to its Dridex operations complicated ransom payments. Researchers and incident reporting linked a progression from BitPaymer/FriedEx and WastedLocker to Hades, Phoenix Locker, PayloadBIN, and Macaw Locker, with analysts citing shared code, tooling, and tradecraft across the families. Security firms said the group also adjusted its operations by leaning on tools such as SocGholish, Cobalt Strike, and the CryptOne packer to blur attribution while continuing enterprise-focused intrusions.
The rebrands were tied to major disruptive attacks on large organizations. Garmin suffered a global outage in a confirmed WastedLocker incident, Forward Air disclosed operational disruption from Hades, and later Olympus and Sinclair Broadcast Group were linked to Macaw Locker, with Sinclair experiencing broadcast interruptions. Reporting said victims were directed to Tor-based negotiation portals and, in some cases, faced demands as high as 450 bitcoin or $40 million, underscoring how Evil Corp preserved its extortion business despite sanctions pressure.
