Hades
Hades is referenced in the provided content as both a ransomware actor/family and an APT/intrusion-set name, and the available information is not sufficient to fully disambiguate all uses. High-confidence reporting in the content shows Hades was identified by Infoblox as one of several ransomware groups that used SocGholish/FakeUpdates infections as an entry point. Separately, Socket Threat Research tracks a broader software supply-chain campaign across the Mini Shai-Hulud, Miasma, and Hades threat clusters; in that reporting, the Hades-family payload is delivered via malicious npm and PyPI artifacts and harvests secrets from developer workstations and CI/CD environments, including package-registry tokens, cloud credentials, Kubernetes material, SSH keys, Docker configurations, shell histories, .env files, and AI developer tool configurations. The content also describes Hades as an elusive, highly dynamic threat actor in NSA reporting on exploitation of Exim CVE-2019-10149 for potentially large-scale mass access. Additional reporting in the content associates Hades with Russia-nexus activity: Kaspersky’s Q2 2019 summary refers to Sofacy/Hades as a Russian-speaking APT grouping, and other cited material says activity resembled earlier “hack and leak” campaigns associated with SOFACY and HADES. One cited source says researchers connected OlympicDestroyer with Hades, and another says Hades is possibly connected to Sofacy and notable for being behind Olympic Destroyer, ExPetr, and disinformation campaigns such as the Macron leaks. The content also mentions Hades among APT actors exploiting COVID-19-themed lures. Known alias in the provided content: hades. Related or associated names mentioned in the content include Sofacy and the sub-clusters Mini Shai-Hulud and Miasma.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
26 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
3 malware families attributed to this actor across reporting.
Associated vulnerabilities
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
Recent activity
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named as one of several ransomware groups that used SocGholish infections as an entry point for follow-on attacks.
A payload associated with the reported worm activity, protected by anti-analysis prompt-injection style comments intended to disrupt AI-assisted malware scanning.
Threat cluster in the Shai-Hulud supply chain campaign associated with payloads that steal secrets from developer workstations and CI/CD environments.
Referenced as a Russia-nexus intrusion set previously associated with hack-and-leak campaigns between 2015 and 2019.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.