Attack, Deconstructed: Hades Ransomeware

Hades ransomware was discovered in a targeted attack across businesses and has been linked by many to the Hafnium group, a state-backed group of hackers.

Classic Hades ransomware attacks include important files being encrypted and seeing 5 characters at the end of the affected file names, for instance “.cm99v” or “.dvxr9.” Hades ransomware attacks also include ransom notes titled, “HOW-DECRYPT- [appended_extension].txt” with demands and instructions, as shown below:

To retrieve lost files and information, the Hades hacking group demands ransom money and very specific instructions. However, it’s important to take a breath and think clearly before taking any action.

Before we cover what you should do if you experience this attack, let’s ensure you’re protected.

Are you Protected?

If you are a Carbon Black or Crowdstrike user, you are protected as this is an out-of the-box feature.

Carbon Black users: you can investigate this ransomware attack by running the following query: ((process_name:attrib.exe)) -enriched:true

If you are not, you might need to blacklist the File IDs below. That depends on the antivirus and other software you use.

If you’re not sure you are protected, feel free to reach out, and we can help you determine if your software has the right capabilities against this ransomware hack.

How can you determine if you've been a victim of this attack?

You will not be able to access important documents as they will be encrypted and have the 5 digit extension on the file name.

To check if you’ve been affected by a Hades ransomware attack, simply search your system for the file extensions: “.cm99v” and “.dvxr9”.

If you find a Hades ransomware file in your system, it's important to take a moment and proceed carefully.

Steps you should take if you have been hacked:

1. Isolate the infected device. If you don’t know how to do this, contact an expert ASAP.
2. Immediately reach out to a cybersecurity expert as who can help you identify the infection, search for decryption tools, restore files and create backups to minimize the breach and loss.
3. Report the ransomware to authorities.