In order to evade United States sanctions, threat group “Evil Corp” has developed and launched a new ransomware classified as “Macaw Locker”. Activity surrounding the group eventually lead them to be sanctioned in 2019, restricting negotiation firms and victims of the group from processing ransom payments to the group. In a valiant effort to thwart these sanctions, Evil Corp rebranded several ransomware operations including “Phoenix Cryptolocker”, “WastedLocker”, “PayloadBin” and “Hades”. To date, Macaw Locker has only targeted two (2) entities: Sinclair and Olympus. Several leaks of the “macaw_locker.txt” ransom note reveal that the threat actors are very direct, only stating that “Data on your network has been stolen and encrypted” which is followed by a recovery link where victims can pay the ransom. Ransom payments for Macaw are ranging from $28 million (~450 Bitcoin) to upwards of $40 million. However, now that Macaw Locker has been publicly exposed, threat actors will likely rebrand once again since the ransomware has been tied to the group. The Ankura CTAPT will continue to gather additional intelligence on Macaw Locker and the threat actors and provide updates accordingly.