Security News > 2021 > March > Evil Corp switches to Hades ransomware to evade sanctions
Hades ransomware has been linked to the Evil Corp cybercrime gang who uses it to evade sanctions imposed by the Treasury Department's Office of Foreign Assets Control.
They later shifted to the ransomware "Business," first using Locky ransomware and then their own ransomware strain known as BitPaymer, deployed in attacks until 2019.
Starting with June 2020, Evil Corp refreshed its tactics to circumvent the sanctions, deploying its new WastedLocker ransomware in attacks targeting enterprise orgs.
Wearable device maker Garmin is one of the high-profile targets Evil Corp hit with its WastedLocker ransomware.
CrowdStrike now linked the cybercrime gang to Hades ransomware based on "Significant code overlap." This new, previously unattributed malware tooling is helping Evil Corp bypass sanctions to monetize their attacks.
While there aren't many Hades ransomware attacks being reported by affected organizations, Evil Corp victims have been using the ID-Ransomware service to check if their systems were hit by Hades ransomware since the group started using the new strain.