{"id":40190,"date":"2021-03-26T14:01:48","date_gmt":"2021-03-26T14:01:48","guid":{"rendered":"https:\/\/packetstormsecurity.com\/news\/view\/32141\/Hades-Ransomware-Operators-Are-Hunting-Big-Game-In-The-US.html"},"modified":"2021-03-26T14:01:48","modified_gmt":"2021-03-26T14:01:48","slug":"hades-ransomware-operators-are-hunting-big-game-in-the-us","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/hades-ransomware-operators-are-hunting-big-game-in-the-us\/","title":{"rendered":"Hades Ransomware Operators Are Hunting Big Game In The US"},"content":{"rendered":"

An unknown threat group is deploying a variant of Hades in targeted attacks against US big game. <\/p>\n

On Friday, Accenture’s Cyber Investigation & Forensic Response (CIFR) and Cyber Threat Intelligence (ACTI) teams published an analysis<\/a> into the latest Hades campaign which has been operating since at least December 2020<\/a> until this month. <\/p>\n

According to the cybersecurity researchers, at least three major companies have been successfully attacked with the ransomware strain including a transport & logistics company, a consumer products retailer, and a global manufacturer. Forward Air<\/a> was reportedly a past victim. <\/p>\n

Accenture says that the threat actors are focused on hunting organizations that generate at least $1 billion in annual revenue.  <\/p>\n

In the latest recorded attacks, the threat actors take a hands-on approach and use a mix of custom tools and fileless approaches.  <\/p>\n

Hades appears to infiltrate systems through internet-facing systems, Remote Desktop Protocol (RDP), or Virtual Private Network (VPN) setups using legitimate credentials — which may be obtained through brute-force attacks or stolen data dumps.  <\/p>\n

Once Hades lands on a victim’s machine, it creates a copy of itself and relaunches itself via the command line. The ‘spare’ copy is then deleted and an executable is unpacked in memory. A scan is then performed in local directories and network shares to find content to encrypt but each Hades sample secured uses a different extension.  <\/p>\n

<\/section>\n

A ransom note, “HOW-TO-DECRYPT-[extension].txt,” is then dropped on the machine.  <\/p>\n

The ransomware notes obtained through Hades samples direct victims to install Tor and a unique address appears to be generated for each target. In total, six have been traced, which may indicate further infections.  <\/p>\n

\"screenshot-2021-03-25-at-13-45-37.png\"<\/span>
<\/span><\/figcaption><\/figure>\n

Similarities between ransom notes used by the Hades group and REvil ransomware operators. CrowdStrike considers<\/a> Hades to be the successor to WastedLocker ransomware<\/a>, a variant that has been deployed by REvil against US targets in past campaigns. <\/p>\n

\"screenshot-2021-03-25-at-11-18-23.png\"<\/span>