S1053 AvosLocker

malwareEnterprise

platformsLinux · Windows

also known asAvosLocker

AvosLocker is ransomware written in C++ that has been offered via the Ransomware-as-a-Service (RaaS) model. It was first observed in June 2021 and has been used against financial services, critical manufacturing, government facilities, and other critical infrastructure sectors in the United States. As of March 2022, AvosLocker had also been used against organizations in Belgium, Canada, China, Germany, Saudi Arabia, Spain, Syria, Taiwan, Turkey, the United Arab Emirates, and the United Kingdom.

techniques used (15)

ATT&CK techniques this enables or maps to.

T1027Obfuscated Files or Information
T1027.007Dynamic API Resolution
T1036.008Masquerade File Type
T1057Process Discovery
T1083File and Directory Discovery
T1106Native API
T1124System Time Discovery
T1135Network Share Discovery
T1140Deobfuscate/Decode Files or Information
T1486Data Encrypted for Impact
T1489Service Stop
T1529System Shutdown/Reboot
T1547.001Registry Run Keys / Startup Folder
T1564.003Hidden Window
T1688Safe Mode Boot

used by campaigns (1)

Campaigns that use this.

C0018C0018

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan