An analysis published by CrowdStrike Intelligence traced the evolution of INDRIK SPIDER — the Russia-based cybercriminal group also known as Evil Corp — from their Dridex/BitPaymer roots through WastedLocker to Hades ransomware, documenting how December 2019 OFAC sanctions and DOJ indictments against leaders Maksim Yakubets and Igor Turashev directly drove the group's rapid and systematic retooling to distance itself from sanctioned tooling and preserve its ability to monetize BGH attacks.
From Dridex to WastedLocker: Sanctions Force a Toolchain Overhaul
INDRIK SPIDER had operated Dridex — a prolific banking trojan active from June 2014 through early 2020 — and the BitPaymer ransomware used in big game hunting (BGH) campaigns from 2017 onward. When OFAC sanctions prohibiting facilitation of significant payments to the group were announced in December 2019, INDRIK SPIDER underwent observable operational shifts in direct response. By January 2020 the group resurfaced using a variant of Gozi ISFB in place of Dridex. By June 2020, after introducing WastedLocker as the BitPaymer successor, the group pivoted to fake browser updates to deliver Cobalt Strike — extensively using the red-teaming tool for initial foothold establishment and lateral movement before deploying WastedLocker in BGH campaigns across more than a dozen sectors, predominantly in the U.S.
Hades: WastedLocker Recompiled and Obfuscated
Based on significant code overlap, CrowdStrike identified Hades — first publicly observed in December 2020 — as a 64-bit recompilation of WastedLocker with additional obfuscation and deliberate removal of features uniquely characteristic of prior INDRIK SPIDER families. The core architecture is preserved: the ISFB-inspired static configuration, multi-staged persistence and installation process, and file and directory enumeration and encryption logic are largely unchanged. Key modifications include:
- 64-bit compilation with code obfuscation: Designed to disguise minimal code changes, evade existing signature-based detections, and hinder reverse engineering.
- Native API substitution: The majority of standard Windows file and registry API calls replaced with their NTDLL Native API (syscall) counterparts, reducing user-mode API hooking exposure.
- Different UAC bypass: Implements a distinct UAC bypass from WastedLocker, though both are sourced from the open-source UACME project.
- Consolidated ransom note: A single
HOW-TO-DECRYPT-.txtper traversed directory replaces WastedLocker's and BitPaymer's per-file individual ransom notes. Victim company names are no longer identified in the note. - Key storage relocation: Encryption key information is now embedded within each encrypted file rather than in the file-specific ransom note — reversing a distinctive BitPaymer and WastedLocker artifact.
- Removal of ADS persistence: Hades no longer uses the
:binAlternate Data Stream path that was characteristic of both WastedLocker and BitPaymer, instead copying itself only to a generated subdirectory in Application Data. - Shift to Tor-based victim communication: Ransom notes direct victims to a Tor hidden site; email-based negotiation and data exfiltration for leverage — previously used in WastedLocker and BitPaymer campaigns — are absent from the Hades model.
Sanctions as a Driver of Adversary Evolution
The Hades evolution illustrates a broader dynamic: legal and financial pressure applied to cybercriminal groups does not eliminate them — it catalyzes toolchain reinvention. INDRIK SPIDER's systematic removal of identifying artifacts (per-file ransom notes, ADS usage, Dridex, BitPaymer code signatures), adoption of commodity red-teaming tools like Cobalt Strike, and progression through three distinct ransomware families in under two years demonstrate the operational resources and resilience that allowed the group to continue BGH operations despite OFAC sanctions, DOJ indictments, and a $5 million USD U.S. State Department bounty on its leader.