MITRE ATT&CKsoftware (malware)
S1053 AvosLocker
- Domain
- enterprise
- Platforms
- Linux, Windows
- Version
- 1.0
- Created
- 2023-01-11
Description
AvosLocker is ransomware written in C++ that has been offered via the Ransomware-as-a-Service (RaaS) model. It was first observed in June 2021 and has been used against financial services, critical manufacturing, government facilities, and other critical infrastructure sectors in the United States. As of March 2022, AvosLocker had also been used against organizations in Belgium, Canada, China, Germany, Saudi Arabia, Spain, Syria, Taiwan, Turkey, the United Arab Emirates, and the United Kingdom.
Related
Uses · MITRE ATT&CK (15)
- T1688 Safe Mode Boot technique
- T1036.008 Masquerade File Type sub-technique
- T1027.007 Dynamic API Resolution sub-technique
- T1564.003 Hidden Window sub-technique
- T1547.001 Registry Run Keys / Startup Folder sub-technique
- T1529 System Shutdown/Reboot technique
- T1489 Service Stop technique
- T1486 Data Encrypted for Impact technique
- T1135 Network Share Discovery technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1027 Obfuscated Files or Information technique
- T1057 Process Discovery technique
- T1083 File and Directory Discovery technique
- T1106 Native API technique
- T1124 System Time Discovery technique
Referenced by MITRE ATT&CK · uses (1)
- C0018 C0018 campaign
References
- https://www.ic3.gov/Media/News/2022/220318.pdf Joint CSA AvosLocker Mar 2022
- https://www.malwarebytes.com/blog/threat-intelligence/2021/07/avoslocker-enters-the-ransomware-scene-asks-for-partners Malwarebytes AvosLocker Jul 2021
- https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-avoslocker Trend Micro AvosLocker Apr 2022