Day 19: Hades Ransomware

Hades operators target remote desktop protocols or virtual private networks, harvesting legitimate credentials. The operators secure privilege escalation by manually enumerating obtained credentials. The attackers perform several evasion techniques including disabling antivirus programs. Finally, the operators implement Hades ransomware through an attacker-controlled server stealing data and encrypting files identified on the victim’s network using the double-extortion tactic. When the files are encrypted, threat actors will display a ransom note telling victims to download the Tor website, open a specific URL, and follow the instructions on how to pay the ransom to decrypt the targeted files.