Day 17: AvosLocker Ransomware

The threat actors manually run the AvosLocker ransomware attempting to remotely access a device or network. When the initial attack is successful, the ransomware maps the accessible drives by listing all the files and selecting certain files for encryption depending on the extensions. Additionally, the ransomware deletes the Shadow Volume Copies of the affected files and terminate specific applications that can interfere with the encryption process. The ransomware will append ‘.avos’ extension to the file’s original name as a new extension upon encrypting the files. Even though the contents are unreadable, there are Base64-encoded blocks added to the files containing RSA-protected AES keys that are used for encrypting the files. A ransom note named, “GET_YOUR_FILES_BACK.txt” is dropped in each attacked directory. Threat actors will increase the ransom amount if the deadline is not met and attempt to blackmail the victims by threatening to dox them. AvosLocker is seeking new affiliates as well as pentester with Active Directory experience and access brokers. AvoLocker is using a partnership program in which they provide affiliates with Windows, Linux and ESXi servers, negotiation assistance, and network resource encryption services.