Log in Request a demo

Ransomware

[Research Summary]: AvosLocker Ransomware

AvosLocker ransomware is a RaaS operation first detected in 2021. See how its affiliates extort victims, which countries and sectors it targets.

Updated 2 Min Read

AvosLocker ransomware is a ransomware-as-a-service operation first detected in 2021. Its operators run an affiliate program, steal data from victims and threaten to publish it on a Tor site if the ransom is not paid. MITRE ATT&CK lists it for Windows and Linux, and CISA reports Windows, Linux and VMware ESXi variants.

This blog post comes from the “In-depth Analysis of AvosLocker Ransomware Report” by the Brandefense CTI Analyst Team. For more details about the analysis, download the report.

Summary

AvosLocker is a group of ransomware detected in 2021, explicitly targeting Windows machines. It is known that AvosLocker is currently being developed to target Linux environments.

According to the RaaS model, the actors behind AvosLocker conduct surveillance before the attack campaign, select their targets based on their ability to pay the requested ransom and shape their attacks accordingly. The threat actors behind AvosLocker also have several underground forums, which could cooperate to reach their goals of Windows Active Directory penetration testing and expert specialists. Additionally, we are looking for people with remote access to the compromised system.

avoslocker post on forum
Figure 1: Sharing posted on the forum for the cooperation announcement

In case the ransom amount demanded as a result of a successful attack attempt from AvosLocker is not paid, the data leaked from the target system is published from the announcement page of AvosLocker hosted on the Tor network.

Onion Site: avosqxh72b5ia23dl5fgwcpndkctuzqvh2iefk5imp3pi5gfhel5klad.onion

avoslocker onion site
Figure 2: AvosLocker ransomware announcement site

AvosLocker, like many other ransomware groups, runs an affiliate program and offers its services to candidates who want to work with AvosLocker.

avoslocker partnership program
Figure 3: Details about the AvosLocker Partnership program

Which countries does AvosLocker target?

  • The United States,
  • Argentina,
  • Australia,
  • Austria,
  • Belgium,
  • Brazil,
  • Canada,
  • China,
  • Colombia,
  • Germany,
  • India,
  • Israel,
  • Italy,
  • The Philippines,
  • Saudi Arabia,
  • Spain,
  • Syria,
  • Taiwan,
  • Turkey,
  • United Arab Emirates,
  • United Kingdom.

Which sectors does AvosLocker ransomware target?

  • Education,
  • Energy,
  • Financial Services,
  • Food and Beverage,
  • Government,
  • Healthcare,
  • Manufacturing,
  • Media,
  • Telecommunications,
  • Transportation,
  • Technology.

This blog post comes from the “In-depth Analysis of AvosLocker Ransomware Report” by the Brandefense CTI Analyst Team. For more details about the analysis, download the report.

Frequently Asked Questions.

What is AvosLocker ransomware?

AvosLocker is a ransomware-as-a-service operation. MITRE ATT&CK describes it as C++ ransomware first seen in June 2021, distributed through affiliates.

Which systems does AvosLocker affect?

MITRE ATT&CK lists Windows and Linux. CISA advisory AA23-284A also reports VMware ESXi environments.

How does AvosLocker pressure victims to pay?

The operators steal data and threaten to leak or publish it. The post says unpaid victims have their data published on the group's Tor announcement page.

Which sectors and countries does AvosLocker target?

The post lists countries such as the United States, Germany and the United Kingdom, and sectors such as education, energy, healthcare and government. MITRE ATT&CK names financial services, critical manufacturing and government facilities.

Sources

  1. 1 CISA: #StopRansomware: AvosLocker Ransomware (Update), AA23-284A
  2. 2 MITRE ATT&CK: AvosLocker (S1053)
Share

In This Article

TermsRansomware TermsMITRE ATT&CK TermsThreat actor TermsUnderground forum TermsActive Directory TermsPenetration testing TermsTor network

Where To Next.

All Ransomware Articles
In plain words · Glossary term Ransomware

Ransomware is malware that encrypts files and systems so they become unusable until a ransom is paid.

Open → Keep reading · Article [Research Summary]:Pandora Ransomware Technical Analysis Report

Pandora ransomware targets corporate networks and uses double extortion.

Open → Keep reading · Article Most Common Attack Vectors & Ransomware Threat Relation

Learn the most common attack vectors, from phishing to brute force, and the top 10 MITRE ATT&CK techniques ransomware operators use, with detection tips.

Open →

Knowledge HubRansomware groups