Skip to content
brandefense.io
Request A Demo
RansomwareFinancial

Hades

Hades is a Russia-attributed ransomware group with a financial motive, tracked by Brandefense. It targets 3 sectors, including Government and Finance, in 4 countries, including the United States and Russia.

Also known as
  • WildFire Locker
  • Hades Locker
  • Operation “TrickyMouse”
Request IOC feedRequest ATT&CK export
Origin
Russia
Techniques
0
Exploited CVEs
No CVE data
First seen
Jan 1, 2017
Record updated

Who They Target.

Sectors · 3
Countries · 4

About Hades.

According to PCrisk, Hades Locker is an updated version of WildFire Locker ransomware that infiltrates systems and encrypts a variety of data types using AES encryption. Hades Locker appends the names of encrypted files with the.~HL[5_random_characters] (first 5 characters of encryption password) extension.

Last updated Sep 22, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.