Netskope Threat Labs

Avaddon

ATP Sandbox Adv. HeuristicsAV

Description

Avaddon is a ransomware family whose first known attack occurred in February 2020 and that targets Windows systems through large scale malicious spam campaigns. It exfiltrates victim data before encrypting files and pressures organizations through a leak site that threatens publication. The operators ran it as a ransomware as a service affiliate program and abruptly shut it down in June 2021 after releasing decryption keys and victim data.

Stats

First seen
March 2022
Last seen
October 2026

Also known as

AvaddonCrypt

MITRE ATT&CK techniques

17 techniques across 7 tactics.

TA0002 Execution

TA0003 Persistence

  • T1547Boot or Logon Autostart Execution

TA0004 Privilege Escalation

  • T1548Abuse Elevation Control Mechanism

TA0005 Stealth

  • T1027Obfuscated Files or Information
  • T1140Deobfuscate/Decode Files or Information

TA0007 Discovery

  • T1016System Network Configuration Discovery
  • T1057Process Discovery
  • T1083File and Directory Discovery
  • T1135Network Share Discovery
  • T1614System Location Discovery

TA0040 Impact

  • T1486Data Encrypted for Impact
  • T1489Service Stop
  • T1490Inhibit System Recovery

TA0112 Defense Impairment

Alert name variants

Alert Name
Gen:Variant.Ransom.Avaddon.20
Gen:Variant.Ransom.Avaddon.3
Gen:Variant.Ransom.Avaddon.60
Gen:Variant.Ransom.Avaddon.66
Gen:Variant.Ransom.Avaddon.67
Script-JS.Ransomware.Avaddon
Trojan.Ransom.Avaddon.A
Win32.Ransomware.Avaddon
Win32.Ransomware.AvaddonCrypt
Win64.Ransomware.Avaddon

Related families

QilinCobalt StrikeInvisiMoleQakBotClop

References