AvosLocker

AvosLocker is a ransomware-as-a-service (RaaS) operation that emerged in June 2021 and is known for double-extortion tactics. Reporting cited in the content says it has targeted entities in the United States, Canada, the United Kingdom, and Spain, with a focus on critical infrastructure. Described initial access vectors include spear-phishing, exploitation of public-facing applications, and compromised RDP credentials. The group has been reported to establish persistence with custom webshells, escalate privileges via credential dumping, exfiltrate data prior to encryption, and reboot systems into Safe Mode with Networking before encrypting files and appending .avos or .avos2 extensions. AvosLocker has been advertised on cybercrime forums including RAMP, where it was listed among RaaS programs and was noted posting buying requests on the same forum where it advertised its service. The content also places AvosLocker among ransomware groups targeting VMware ESXi environments and among more than 30 ransomware groups exploiting routinely exploited vulnerabilities. Additional reporting in the content states FIN7 sold its AvNeutralizer tool to multiple ransomware gangs including AvosLocker. The group is also mentioned in reporting on the post-Conti ecosystem: multiple sources cited in the content state Conti members dispersed into or partnered with operations including AvosLocker after Conti’s decline. The content does not attribute AvosLocker to a nation state.