AvosLocker Ransomware group has targeted 50+ Organizations Worldwide
AvosLocker Ransomware group has targeted 50+ Organizations Worldwide
THREAT LEVEL: Red.
For a detailed advisory, download the pdf file here
Federal Bureau of Investigation and Cybersecurity and Infrastructure Security Agency released threat advisories on AvosLocker Ransomware. It is a Ransomware as a Service (RaaS) affiliate-based group that has targeted 50+ organizations in critical infrastructure sectors such as financial services, manufacturing plants, and government facilities in countries such as the United States, Saudi Arabia, the United Kingdom, Germany, Spain, and the United Arab Emirates, among others. After it’s affiliates infect targets, AvosLocker claims to handle ransom negotiations, as well as the publishing and hosting of exfiltrated victim data.
The AvosLocker ransomware is a multi-threaded C++ Windows executable that operates as a console application and displays a log of actions performed on victim computers. For the delivery of the ransomware payload, the attackers use spam email campaigns as the initial infection vector. The threat actors exploits Proxy Shell vulnerabilities CVE-2021-31206, CVE-2021-31207, CVE-2021-34523, and CVE-2021-34473, as well as CVE-2021-26855 to gain access to victim’s machine and then they deploy Mimikatz to steal passwords. Furthermore, threat actors can use the detected credentials to get RDP access to the domain controller and then exfiltrate data from the compromised machine. Finally, the attacker installs AvosLocker ransomware on the victim’s computer and then encrypts the victim’s documents and files with the “.avos” extension. The actor then leaves a ransom letter in each directory named “GET YOUR FILES BACK.txt” with a link to an AvosLocker .onion payment site.
The Organizations can mitigate the risk by following the recommendations: •Keep all operating systems and software up to date. •Remove unnecessary access to administrative shares. •Maintain offline backups of data and Ensure all backup data is encrypted and immutable.
The MITRE TTPs commonly used by Avoslocker are:
TA0001: Initial Access
TA0002: Execution
TA0007: Discovery
TA0040: Impact
T1566: Phishing
T1204: User Execution
T1082: System Information Discovery
T1490: Inhibit System Recovery
T1489: Service Stop
T1486: Data Encrypted for Impact
Actor Detail
Vulnerability Details
Indicators of Compromise (IoCs)
Patches
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31206
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31207
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34473
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34523
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26855
Recent Breaches
Reference
