Both Russia and Ukraine have traditionally been cybercrime hotspots, so it's not surprising that some hackers will step up to support their governments when their countries are engaged in a military conflict. However, since the war in Ukraine started we've seen examples of traditional cybercriminal groups taking sides, a noteworthy example being the now defunct Conti ransomware gang which threatened to launch attacks against Western critical infrastructure in support of Russia. In general, hacktivists are driven by ideology or nationalism, whereas the majority of cybercriminals are motivated by financial gain and prefer to remain apolitical, treating their malicious activities as purely business. The PHANTOM DEV group itself was involved in hacktivist activities last year and claimed to be affiliated with a larger pro-Russia hacktivist group known as the Red Hackers Alliance Russia (RHA R). AiD Lock is not a newcomer to malware development and was previously associated with the AiD Locker ransomware-as-a-service (RaaS) program as well as with a group called PHANTOM DEV or DeadXInject Hack.

Security researchers from threat intelligence firm Intel 471 first spotted AresLoader in November when it was advertised by a user with the monikers AiD Lock and DarkBLUP on Telegram and two well-known underground forums. The malicious program appears to be developed and used by several members of a pro-Russia hacktivist group and is typically distributed inside decoy installers for legitimate software.

Security researchers have started seeing attack campaigns that use a relatively new malware-as-a-service (MaaS) tool called AresLoader.

Ccleaner key pro