Hades

Also known as: Hades, Operation “TrickyMouse”

ransomware

🌍 Country ["Russia"]

Associated Operations

2019-06 2020-02 Attacks pretend to be from the Center for Public Health of the Ministry of Health of Ukraine and deliver bait document containing the latest news regarding #COVID-19. A backdoor written in C# gets dropped by malicious macro code to perform remote control. Hades Operation “TrickyMouse” https://mp.weixin.qq.com/s/o6KC0k43AuOY5F8FKGbmMg https://securelist.com/olympic-destroyer-is-still-alive/86169/ https://twitter.com/RedDrip7/status/1230683740508000256 the actor behind Olympic Destroyer is still alive

Introduction

ransomware

Activities and Tactics

Country of Origin: 🇷🇺 [“Russia”]

Notable Campaigns

  • 2019-06
  • 2020-02
  • Attacks pretend to be from the Center for Public Health of the Ministry of Health of Ukraine and deliver bait document containing the latest news regarding #COVID-19. A backdoor written in C# gets dropped by malicious macro code to perform remote control.
  • Hades
  • Operation “TrickyMouse”
  • https://mp.weixin.qq.com/s/o6KC0k43AuOY5F8FKGbmMg
  • https://securelist.com/olympic-destroyer-is-still-alive/86169/
  • https://twitter.com/RedDrip7/status/1230683740508000256
  • the actor behind Olympic Destroyer is still alive

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

  • Brave Prince:
  • Gold Dragon:
  • Olympic Destroyer:
  • RunningRAT:

Attribution and Evidence

Country of Origin: [“Russia”] Additional attribution information pending cataloguing.

References

References pending cataloguing.