hades

Hades is a ransomware group first observed in December 2020, believed by several threat intelligence firms to be operated by, or closely linked to, the Evil Corp cybercrime syndicate. The group has primarily targeted large enterprises in the United States, Canada, and Germany, conducting big-game hunting operations. Hades is not known to operate as an open Ransomware-as-a-Service (RaaS) platform; instead, attacks appear to be conducted by the core operators. It uses a double-extortion model, encrypting systems and threatening to leak stolen data via a Tor-based portal. The ransomware payload is typically deployed after extensive network reconnaissance and lateral movement, often through compromised VPN credentials and exploitation of exposed services. Encrypted files are appended with the .hades extension, and ransom notes direct victims to unique Tor portals for negotiation. Notable sectors affected include manufacturing, transportation, and consumer goods.