Loading malware…
AvosLocker is a ransomware family and ransomware-as-a-service operation first identified in 2021 that initially targeted Windows environments and later expanded to Linux, including VMware ESXi infrastructure. It is associated with enterprise-focused intrusions and double-extortion activity in which operators steal data before encrypting systems and threaten public disclosure if victims do not pay. The operation has maintained an affiliate model and has been observed in attacks against business environments across multiple regions.
On Windows, AvosLocker encrypts files and drops ransom notes while using multithreading, mutex-based execution control, drive and network-resource enumeration, and exclusion logic for selected files and folders. Reported Windows variants have used extensions such as .avos and .avos2. The malware has also been observed using defense-evasion measures including hiding its console window with the ShowWindow API, modifying settings to impair Windows Defender, terminating security-related processes and services, and abusing Safe Mode boot to reduce the effectiveness of endpoint protections.
AvosLocker’s Linux variant is an ELF encryptor designed for VMware ESXi environments. It accepts command-line parameters for target path and thread count, checks for ESXi and VMFS-related conditions, and attempts to stop running virtual machines before encrypting files so that VM disk and snapshot data can be processed successfully. Reported Linux variants append .avoslinux to encrypted files and drop a ransom note named README_FOR_RESTORE. Analyses describe the Linux branch as using multithreaded encryption with synchronization controls and targeting virtualization infrastructure to maximize operational impact.
Initial access associated with AvosLocker intrusions has included spearphishing and spam-delivered malware, exploitation of Microsoft Exchange ProxyShell-related vulnerabilities, and abuse of weak or exposed RDP access. Post-compromise activity attributed to AvosLocker operators or affiliates includes credential theft with Mimikatz, Active Directory discovery, lateral movement with administrative tools, disabling security controls, deleting recovery artifacts, and exfiltrating data to cloud-sharing services prior to ransomware deployment. AvosLocker has also been repeatedly cited as an early adopter of Safe Mode-based defense evasion later seen in other ransomware operations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
8 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Cyble Research Labs found through dark/deepweb research that the Threats Actors (TAs) or affiliates of AvosLocker ransomware groups are using Proxyshell to exploit Microsoft Exchange Server vulnerabilities compromising victim’s network, such as CVE-2021-34473, CVE-2021-31206, CVE-2021-34523, and CVE-2021-31207. | AvosLocker is a ransomware group identified in 2021, specifically targeting Windows machines... a new Linux variant of AvosLocker ransomware targeting VMware ESXi servers.
the following three ransomware families are being observed in the majority of recent attacks: Similar to many other ransomware families, Hive, Conti, and Avoslocker follow the ransomware-as-a-service (RaaS) business model.
the following three ransomware families are being observed in the majority of recent attacks: Similar to many other ransomware families, Hive, Conti, and Avoslocker follow the ransomware-as-a-service (RaaS) business model.
Cyble Research Labs found through dark/deepweb research that the Threats Actors (TAs) or affiliates of AvosLocker ransomware groups are using Proxyshell to exploit Microsoft Exchange Server vulnerabilities compromising victim’s network, such as CVE-2021-34473, CVE-2021-31206, CVE-2021-34523, and CVE-2021-31207. | AvosLocker is a ransomware group identified in 2021, specifically targeting Windows machines... a new Linux variant of AvosLocker ransomware targeting VMware ESXi servers.
the following three ransomware families are being observed in the majority of recent attacks: Similar to many other ransomware families, Hive, Conti, and Avoslocker follow the ransomware-as-a-service (RaaS) business model.
the following three ransomware families are being observed in the majority of recent attacks: Similar to many other ransomware families, Hive, Conti, and Avoslocker follow the ransomware-as-a-service (RaaS) business model.
Cyble Research Labs found through dark/deepweb research that the Threats Actors (TAs) or affiliates of AvosLocker ransomware groups are using Proxyshell to exploit Microsoft Exchange Server vulnerabilities compromising victim’s network, such as CVE-2021-34473, CVE-2021-31206, CVE-2021-34523, and CVE-2021-31207. | AvosLocker is a ransomware group identified in 2021, specifically targeting Windows machines... a new Linux variant of AvosLocker ransomware targeting VMware ESXi servers.
the following three ransomware families are being observed in the majority of recent attacks: Similar to many other ransomware families, Hive, Conti, and Avoslocker follow the ransomware-as-a-service (RaaS) business model.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
AvosLocker is a ransomware group that was identified in 2021, specifically targeting Windows machines. Now a new variant of AvosLocker malware is also targeting Linux environments.
22 distinct techniques documented for this family, organized by ATT&CK tactic.
Может распространяться путём взлома через незащищенную конфигурацию RDP, с помощью email-спама и вредоносных вложений, обманных загрузок, ботнетов, эксплойтов, вредоносной рекламы, веб-инжектов, фальшивых обновлений
Эти сценарии изменяют или удаляют ключи реестра, принадлежащие определенным инструментам безопасности конечных точек
Examples include AppleSeed using HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce, AvosLocker executed via the RunOnce Registry key, NanoCore creating a RunOnce key, and the content listing HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce and RunOnceEx paths. | Numerous malware families and threat groups are described as achieving persistence by adding values under Run/RunOnce/Policies\Explorer\Run Registry keys or by placing shortcuts/files in the Windows Startup folder.
Additionally, adversaries may exploit legitimate drivers from anti-virus software to gain access to kernel space (i.e. Exploitation for Privilege Escalation), which may lead to bypassing anti-tampering features.
Examples include AppleSeed using HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce, AvosLocker executed via the RunOnce Registry key, NanoCore creating a RunOnce key, and the content listing HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce and RunOnceEx paths. | Numerous malware families and threat groups are described as achieving persistence by adding values under Run/RunOnce/Policies\Explorer\Run Registry keys or by placing shortcuts/files in the Windows Startup folder.
Most of the strings in the malware are kept in the XOR encrypted format. The decryption routines are similar, only registers and keys are different. Strings are decrypted just before their use.
The content repeatedly describes malware and threat actors decoding, decrypting, deobfuscating, or unpacking payloads, strings, configuration data, commands, and C2 responses prior to execution or use.
Agent Tesla has used ProcessWindowStyle.Hidden to hide windows. APT-C-36 has set the ShowWindow property of the Win32_ProcessStartup object to zero to hide PowerShell execution. APT19 used -W Hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden.
The content repeatedly describes malware and threat actors obtaining lists of running processes, using utilities such as tasklist, ps, WMI, Get-Process, CreateToolhelp32Snapshot, EnumProcesses, and similar APIs/commands to enumerate active processes on victim systems.
Finally, AvosLocker ransomware gets deployed on the victim system by the attacker to encrypt the victim’s documents and files.
After execution, the AvosLocker checks the presence of VMware ... and kills the Virtual Machines (VMs) if they are running
45 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
44 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware family mentioned as another prior example of abusing Safe Mode to weaken endpoint defenses before encryption.
Referenced as another ransomware family known for using Safe Mode tactics to impair defenses.
Referenced as another ransomware family known for using Safe Mode tactics to impair security tools prior to ransomware execution.
Referenced as an older ransomware family associated with Safe Mode reboot tactics to evade security tooling.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.