HadesMalware
According to PCrisk, Hades Locker is an updated version of WildFire Locker ransomware that infiltrates systems and encrypts a variety of data types using AES encryption. Hades Locker appends the names of encrypted files with the ".~HL[5_random_characters] (first 5 characters of encryption password)" extension.From MISP Galaxy
Last reported 2 months ago, by Zscaler ThreatLabz4 reports
ATT&CK techniques
5 techniques · each with the sentence it comes from- T1027.009Embedded Payloads
“Accordingly, the analysis below is based on static examination of the binary and its embedded payloads.”
- T1036Masquerading
“Masquerading within Apple’s com.apple.* namespace is a tactic widely used in many macOS malware families, including those previously tied to DPRK-linked activities.”
- T1110Brute Force
“Determines how many failed login attempts will trigger an account lockout, ensuring protection against brute force attacks.”
- T1558.001Golden Ticket
“Unlike Golden Tickets, which involve forging a TGT entirely from scratch using only the KRBTGT key and essential metadata, Diamond Tickets take a more “genuine” approach.”
- T1558.002Silver Ticket
“only difference between Diamond and Golden or Silver tickets is this initial AS exchange, making the authentication flow appear more legitimate on the surface.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
4 reports, newest first · the exact sentence from each-
Tracking Shai-Hulud: Inside the ChainDrop NPM Worm“Hades”
-
macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox“Socket has since documented a Hades supply-chain payload whose stealer opens with a fake prompt-injection header to pollute AI-assisted analysis, while the leaked Shai-Hulud code carried an “Anthropic Magic String” intended to stop Claude Code from analyzing it.”
-
Shai-Hulud Campaign Evolution: Miasma, Hades, and AI Scanner Evasion“Shai-Hulud Campaign Evolution: Miasma, Hades, and AI Scanner Evasion”
-
Recutting the Kerberos Diamond Ticket“…reating a POC weaponization, Elad Shamir sent us Tim Medin’s DerbyCon 2014 talk, ‘Attacking Microsoft Kerberos: Kicking the Guard Dog of Hades.’ In his talk,”
Indicators in its reports
named in the reports above- 5555494492fc075f…4913dde3a2eain 1 report
- com[.]applein 1 report
- 6328567511d88fdc…4f12f4982525in 1 report
- 77b4fd46994992f0…f5c4536e77cain 1 report
- baabf249c77bc54c…b73ab8741239in 1 report
- e4503e31d5a297d9…75684f68e080in 1 report
- f92ee93a0af971a3966bfa8efa9c2625in 1 report
- 7bcf8d9f6834c44450eac145a967d2f2in 1 report
- 4140f7e17e6f97f83aa3472473e01addin 1 report
- hxxps://npm-cache[.]com/routerin 1 report
- npm-cache[.]comin 1 report
- awqhnjewqjkl[.]icuin 1 report
- npmjs[.]helpin 1 report
- scanning[.]inin 1 report
- fulcio.sigstore[.]devin 1 report
- dc48b09b2a5954f7…a923cb4c0efein 1 report
- e1342a80d4b5e83d…180c93a4b17din 1 report
- c539766062555d47…a668975e275cin 1 report
- models.litellm[.]cloudin 1 report
- hxxps://api.anthropic[.]com/v1/apiin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.