Hades is a crime group operating an improved WildFire Locker ransomware targeting individual and corporate users.
Hades is a crime group operating an updated version of the WildFire Locker ransomware. It targets a broad range of individual and corporate users by encrypting various data types with AES encryption. The ransomware appends the .~HL[5_random_characters] extension to compromised files. Defenders should focus on detecting this specific file extension pattern and known WildFire Locker TTPs.
According to PCrisk, Hades Locker is an updated version of WildFire Locker ransomware that infiltrates systems and encrypts a variety of data types using AES encryption. Hades Locker appends the names of encrypted files with the .~HL[5_random_characters] (first 5 characters of encryption password) extension.
The Hades ransomware appends the .~HL[5_random_characters] extension to encrypted files.
Hades is considered an updated version of the WildFire Locker ransomware.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.