AvaddonMalware
Avaddon is a ransomware malware targeting Windows systems often spread via malicious spam. The first known attack where Avaddon ransomware was distributed was in February 2020. Avaddon encrypts files using the extension.avdn and uses a TOR payment site for the ransom payment.From MISP Galaxy
Last reported 1 month ago, by ESET WeLiveSecurity (ES)2 reports
ATT&CK techniques
4 techniques · each with the sentence it comes from- T1003.001LSASS Memory
“…ames and passwords and also usernames and password hashes (T1550.002) which are usually retrieved by threat actors through LSASS Dump (T1003.001) during the intrusions.”
- T1053.005Scheduled Task
“In the following image, there can be seen two procedures: the first guides the threat actors to create a scheduled task to execute the ransomware in the Netlogon folder by using Windows cmd; whereas the second guides the threat actors to place the ransomware in the Netlogon folde…”
- T1068Exploitation for Privilege Escalation
“The software requires a password to run and uses the vulnerable driver TfSysMon.sys (T1068) to terminate around 96 processes related to AV and EDR solutions.”
- T1550.002Pass the Hash
“The credentials can be usernames and passwords and also usernames and password hashes (T1550.002) which are usually retrieved by threat actors through LSASS Dump (T1003.001) during the intrusions.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Panorama de amenazas digitales en México: qué cambió en el primer semestre de 2026“…acute;nico país de la región donde se registraron señales de grupos como DarkSide, Cl0p, Mallox, Nemty, Kasseika y Avaddon, confirmando que las organizaciones locales enfrentan una diversidad de actores dirigidos significativamente superior al promedio region…”
-
Ransomware debris: an analysis of the RansomHub operation“Also in December 2023, NoEscape ransomware group (aka Avaddon) executed an exit scam followed by ALPHV on Mar 5, 2024, raising even more uncertainty and fear in those partnering with Ransomware-as-a-Service groups.”
Indicators in its reports
named in the reports above- operations[.]inin 1 report
Copy this indicator · defanged
Thanks — we review every report.