This blog post comes from the “In-depth Analysis of AvosLocker Ransomware Report” by the Brandefense CTI Analyst Team. For more details about the analysis, download the report.
Summary
AvosLocker is a group of ransomware detected in 2021, explicitly targeting Windows machines. It is known that AvosLocker is currently being developed to target Linux environments.
According to the RaaS model, the actors behind AvosLocker conduct surveillance before the attack campaign, select their targets based on their ability to pay the requested ransom and shape their attacks accordingly. The threat actors behind AvosLocker also have several underground forums, which could cooperate to reach their goals of Windows Active Directory penetration testing and expert specialists. Additionally, we are looking for people with remote access to the compromised system.
In case the ransom amount demanded as a result of a successful attack attempt from AvosLocker is not paid, the data leaked from the target system is published from the announcement page of AvosLocker hosted on the Tor network.
Onion Site: avosqxh72b5ia23dl5fgwcpndkctuzqvh2iefk5imp3pi5gfhel5klad.onion
AvosLocker, like many other ransomware groups, runs an affiliate program and offers its services to candidates who want to work with AvosLocker.
Targeted Countries by Avoslocker
- The United States,
- Argentina,
- Australia,
- Austria,
- Belgium,
- Brazil,
- Canada,
- China,
- Colombia,
- Germany,
- India,
- Israel,
- Italy,
- The Philippines,
- Saudi Arabia,
- Spain,
- Syria,
- Taiwan,
- Turkey,
- United Arab Emirates,
- United Kingdom.
Targeted Sectors from Avoslocker Ransomware
- Education,
- Energy,
- Financial Services,
- Food and Beverage,
- Government,
- Healthcare,
- Manufacturing,
- Media,
- Telecommunications,
- Transportation,
- Technology.
This blog post comes from the “In-depth Analysis of AvosLocker Ransomware Report” by the Brandefense CTI Analyst Team. For more details about the analysis, download the report.
