AvosLockerMalware
- avos
AvosLocker is a ransomware-as-a-service (RaaS) gang that first appeared in mid-2021. It has since become notorious for its attacks targeting critical infrastructure in the United States, including the sectors of financial services, critical manufacturing, and government facilities. In March 2022, the FBI and US Treasury Department issued a warning about the attacks.From MISP Galaxy
Last reported 2 months ago, by Infosecurity Magazine2 reports
ATT&CK techniques
6 techniques · each with the sentence it comes from- T1021.001Remote Desktop Protocol
“The attacker then accessed the domain controller via Remote Desktop Protocol (RDP) and began Active Directory (AD) enumeration, following a similar playbook to many Akira attacks, Huntress explained.”
- T1688Safe Mode Boot
“This is a common approach for ransomware actors; in fact, it is listed by MITRE ATT&CK (T1688) as “Impair Defences: Safe Mode Boot.” Although not spotted in relation to Akira previously, the technique has been associated with groups like Snatch and AvosLocker “for years,” Huntres…”
- T1018Remote System Discovery
“Active Directory enumeration output (T1087/T1018)”
- T1087Account Discovery
“Active Directory enumeration output (T1087/T1018)”
- T1560.001Archive via Utility
“Collection — archive of file shares (T1560.001)”
- T1567.002Exfiltration to Cloud Storage
“Exfiltration to attacker S3 bucket (T1567.002)”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Akira Affiliate Crashes Ransomware After Attempting EDR Evasion“…: Safe Mode Boot.” Although not spotted in relation to Akira previously, the technique has been associated with groups like Snatch and AvosLocker “for years,” Huntress claimed.”
-
Akira Hits Safe Mode: Ransomware Rebooting Around EDR“Ransomware families like Snatch and AvosLocker have abused Safe Mode for years, but this is the first reported tie to Akira that Huntress has observed.”
Indicators in its reports
named in the reports above- 72.23.77[.]35in 1 report
- e2356c742c74cce5…061a95b3299ain 1 report
- 414b9985f46714f4…575378127a56in 1 report
Copy these 3 indicators · defanged
Thanks — we review every report.