Evil_Corp__2022__S1_-SentinelLabs_SanctionsBeDamned_final_02.pdf

SentinelLabs provides an in-depth technical analysis linking multiple ransomware families (WastedLocker → Hades → PhoenixLocker → PayloadBIN → Cypherpunk/Macaw) to a single Evil Corp development ‘factory’, documenting strong code reuse, a shared CryptOne packer signature, overlapping infrastructure (SocGholish/Cobalt Strike C2s), TTPs for defense evasion and encryption, YARA rules, and numerous IoCs to assist detection and attribution.