Phoenix Cryptolocker
Phoenix Cryptolocker is a ransomware group with a financial motive, tracked by Brandefense. It targets the Finance, and Defense and Aerospace sectors in the United States.
Also known as
- G0119
- Techniques
- 0
- Exploited CVEs
- No CVE data
- Record updated
Who They Target.
Sectors · 2
Countries · 1
Labelsransomware
About Phoenix Cryptolocker.
A financially motivated, Russia-based, highly sophisticated cybercrime syndicate collaborating with state-sponsored elements (FSB). The group continuously rebrands its ransomware (WastedLocker, Hades, Phoenix Cryptolocker, Macaw, Evil Corp) to evade US sanctions (OFAC) and targets large organizations in Big Game Hunting campaigns.
Last updated Sep 30, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.