Share Blog Post
Origin: June 2021
Aliases: None
Targeted Sectors: Manufacturing, Financial Services, Government, Automotive, Trucking, Healthcare, Hospitality, Education, Retail
Targeted Regions: The U.S., Syria, Saudi Arabia, Germany, Spain, Belgium, Turkey, the United Arab Emirates, the U.K, Canada, China, Taiwan
Motive: Financial gain
Common Infection Vectors: Spam, Phishing, Zero-day and other vulnerabilities
Introduction
AvosLocker, a ransomware strain that emerged following the absence of REvil, was initially detected in late June of 2021 and its operators have subsequently introduced various iterations since then. Over the period, they seized the opportunity to expand their ranks, enlisting additional team members and Initial Access Brokers (IABs). AvosLocker affiliates practice double extortion tactics, and, operating as a Ransomware-as-a-Service (RaaS) model, AvosLocker selectively targets organizations capable of meeting the ransom demands.
AvosLocker mostly targets critical infrastructure across the U.S., with incidents also documented in countries like Canada, the U.K, and Spain. It has been able to gradually establish itself as a notable threat, while also prompting the FBI to issue a warning against its activities.
Tactics, Techniques, and Procedures
AvosLocker is a multi-threaded Windows executable written in C++. It began its voyage into the cybercrime world by targeting Windows systems and, roughly six months later, it introduced a Linux variant capable of targeting ESXi virtual machines. Around the same time, the ransomware evolved to run in Safe Mode, more so because endpoint security products do not run in that mode.
AvosLocker operates as a console application, displaying a log of actions performed on victim systems. The ransomware supports optional command line arguments to enable or disable certain features, providing flexibility to the attacker. Besides, it creates a mutex object as an infection marker to prevent the system from getting infected twice.
Tools used
AvosLocker affiliates use a number of legitimate software and open-source tools during their intrusions to conduct data exfiltration-based extortion.
- For initial access, AvosLocker affiliates use remote system administration tools such as Splashtop Streamer, Tactical RMM, SoftPerfect Network Scanner, PuTTy, AnyDesk, PDQ Deploy, and Atera Agent for backdoor access.
- They use custom PowerShell scripts to enable privilege escalation and lateral movement, and also to disable installed antivirus solutions. They also used custom .bat scripts in some scenarios.
- Also, the affiliates have used legitimate Windows tools, such as PsExec and Nltest in their execution.
- Custom webshells are put to work to enable network access and maintain persistence.
- Furthemore, criminals leverage open-source applications Lazagne and Mimikatz to pilfer credentials, and used FileZilla and Rclone for data exfiltration.
- Experts have witnessed the use of open-source networking tunneling tools like Ligolo and Chisel in AvosLocker's operatoins.
- Other publicly available tools that the affiliates have used are Notepad++, RDP Scanner, and 7-Zip.
Encryption process
Before encryption, the ransomware scans accessible drives and enumerates files in directories. It then encrypts these files and appends specific file extensions such as ".avos," ".avos2," or "AvosLinux" to the encrypted files.
The encryption process utilizes RSA AES-256 to encrypt files and the ChaCha20 algorithm to encrypt encryption-related information, with claims of being one of the fastest ransomware variants available. File inclusion for encryption is determined by the file extensions.
In every directory where files are encrypted, AvosLocker creates a ransom note named "GET_YOUR_FILES_BACK.txt." This note contains instructions for the victim on how to recover their files. In some cases, the text from the ransom note ("GET_YOUR_FILES_BACK.txt") is reproduced on the desktop wallpaper of infected servers.
Extortion
AvosLocker follows the double extortion model, compelling victims to pay for both a decryptor and the non-disclosure of stolen data. With the introduction of its RaaS service, AvosLocker established a Tor-based blog to name non-compliant victims and expose their stolen data. Hence, the operators have a public leak site separate from the ransom negotiation site. They list non-paying victims along with a sample of data allegedly stolen from victims' networks. Visitors to this site can view a sample of victim data and even purchase victim data.
In some cases, AvosLocker victims receive phone calls from representatives of the ransomware operators. These callers encourage victims to visit the Tor site to negotiate and may threaten to post stolen data online. Additionally, AvosLocker operators may threaten and execute DDoS attacks during negotiations to further pressurize the victims.
Abusing zero-days and other bugs
The intrusion methods are mostly dependent on the expertise of the AvosLocker affiliate responsible for infiltrating the network of a victim. Meanwhile, affiliates have leveraged known vulnerabilities in Microsoft Exchange, including CVE-2021-34473, CVE-2021-31206, CVE-2021-34523, CVE-2021-31207, ProxyLogon vulnerabilities (CVE-2021-26855 and CVE-2021-27065. The affiliates have also been observed abusing zero-day vulnerabilities to target victims, which is a common characteristic of advanced ransomware groups.
In June 2022, cybercriminals exploited Log4j (CVE-2021-44228), a zero-day critical vulnerability found in the Apache Log4j 2 Java-based logging library. The same month, it was spotted abusing the OGNL injection vulnerability (CVE-2022-26134) affecting Atlassian Confluence Server and Data Center instances for initial access to corporate networks.
Some AvosLocker affiliates exploited a high-risk vulnerability related to Apache Log4j (CVE-2021-45046) as well.
Avoiding detection
The attackers have migrated their infrastructure to hosts running on legitimate public hosting services, making it challenging to detect and mitigate their operations. Additionally, the ransomware strain manipulates file uploads to evade security checks, potentially achieving remote code execution for complete system compromise. The ransomware also possesses mechanisms to evade sandbox detection and perform lateral movement.
Victimology
Multiple U.S. critical infrastructure organizations across industries—including government, financial services, and critical manufacturing—have been targeted by the AvosLocker RaaS operation. As per the leak site claims, its affiliates have targeted organizations in Syria, Saudi
Arabia, Germany, Spain, Belgium, Turkey, the United Arab Emirates, the U.K, Canada, China, and Taiwan.
With respect to sectors, the criminals predominantly target industrial, commercial, and SMB entities, with a focus on industries such as automotive, trucking, banking sector, healthcare, hospitality, education, and retail.
By February 2022, there were over 60 different victims mentioned in AvosLocker’s leak site. Some publicly disclosed victims of AvosLocker are Pacific City Bank, GIGABYTE Technology, Christus Health, Savannah College of Art and Design (SCAD), Bluefield University, and more.
Mitigation
Besides basic safety practices, some of the top recommendations coming from the FBI and the CISA are:
- Secure remote access tools by implementing application controls to manage and control the execution of software, including allowlisting remote access programs
- Strictly limit the use of RDP and other remote desktop services.
- Restrict the use of PowerShell, using Group Policy, and only grant access to specific users on a case-by-case basis.
- It's advised to configure the Windows Registry to require User Account Control (UAC) approval for any PsExec operations, making administrator privileges mandatory.
Other than that, it is recommended to maintain offline backups of an organization's critical data, while also having a backup recovery plan in place. This would help retain multiple copies of sensitive data and servers in physically separate locations.
Furthermore, security teams must leverage advanced threat intelligence platforms to automatically enrich, analyze, and operationalize threat intel around ransomware threats such as AvosLocker to proactively mitigate the threat.
With Cyware’s collaborate platform, security teams can also automatically share, receive, store, and manage threat detections including SIEM rules files, YARA Rules, Sigma Rules, log sources, Suricata, Snort Rules (and more), analytics files such as CAR, Automated playbooks, and MITRE ATT&CK data and lower their threat detection time.
Summary
To date, the AvosLocker ransomware group continues to expand its arsenal with more legitimate and malicious tools. Its affiliates use a variety of tools, including PowerShell and open-source software, to infiltrate and persist on networks and exfiltrate data. To safeguard systems, organizations and individuals must adhere to the joint Cybersecurity Advisory (CSA) issued by the FBI and the CISA, to be cognizant of known IOCs, TTPs, and detection methods associated with the AvosLocker.
Indicators of Compromise
MD5
829f2233a1cd77e9ec7de98596cd8165
6ebd7d7473f0ace3f52c483389cab93f
10ef090d2f4c8001faadb0a833d60089
8227af68552198a2d42de51cded2ce60
9d0b3796d1d174080cdfdbd4064bea3a
af31b5a572b3208f81dbf42f6c143f99
1892bd45671f17e9f7f63d3ed15e348e
cc68eaf36cb90c08308ad0ca3abc17c1
646dc0b7335cffb671ae3dfd1ebefe47
609a925fd253e82c80262bad31637f19
c6a667619fff6cf44f447868d8edd681
3222c60b10e5a7c3158fd1cb3f513640
90ce10d9aca909a8d2524bc265ef2fa4
44a3561fb9e877a2841de36a3698abc0
5cb3f10db11e1795c49ec6273c52b5f1
44a3561fb9e877a2841de36a3698abc0
122ea6581a36f14ab5ab65475370107e
c82d7be7afdc9f3a0e474f019fb7b0f7
e09183041930f37a38d0a776a63aa673
d3cafcd46dea26c39dec17ca132e5138
f659d1d15d2e0f3bd87379f8e88c6b42
afed45cd85a191fe3b2543e3ae6aa811
31f8eedc2d82f69ccc726e012416ce33
a39b4bea47c4d123f8195a3ffb638a1b
504bd1695de326bc533fde29b8a69319
eb45ff7ea2ccdcceb2e7e14f9cc01397
d285f1366d0d4fdae0b558db690497ea
cf0c2513b6e074267484d204a1653222
SHA1
2d1ce0231cf8ff967c36bbfc931f3807ddba765c
05c63ce49129f768d31c4bdb62ef5fb53eb41b54
6f110f251860a7f6757853181417e19c28841eb4
9c8f5c136590a08a3103ba3e988073cfd5779519
e8c26db068914df2083512ff8b24a2cc803ea498
dab33aaf01322e88f79ffddcbc95d1ad9ad97374
e60ef891027ac1dade9562f8b1de866186338da1
67f0c8d81aefcfc5943b31d695972194ac15e9f2
2f3273e5b6739b844fe33f7310476afb971956dd
f6f94e2f49cd64a9590963ef3852e135e2b8deba
SHA 256
e68f9c3314beee640cc32f08a8532aa8dcda613543c54a83680c21d7cd4 9ca0f
48dd7d519dbb67b7a2bb2747729fc46e5832c30cafe15f76c1dbe3a249e 5e731
ad5fd10aa2dc82731f3885553763dfd4548651ef3e28c69f77ad035166d 63db7
cdca6936b880ab4559d3d96101e38f0cf58b87d07b0c7bf708d078c2bf209460
0cd7b6ea8857ce827180342a1c955e79c3336a6cf2000244e5cfd4279c5fc1b6
10ab76cd6d6b50d26fde5fe54e8d80fceeb744de8dbafddff470939fac6a98c4
e9a7b43acdddc3d2101995a2e2072381449054a7d8d381e6dc6ed64153c9c96a e737c901b80ad9ed2cd800fec7c2554178c8afab196fb55a0df36acda1324721
cdca6936b880ab4559d3d96101e38f0cf58b87d07b0c7bf708d078c2bf209460
7c935dcd672c4854495f41008120288e8e1c144089f1f06a23bd0a0f52a544b1
a0b4e3d7e4cd20d25ad2f92be954b95eea44f8f1944118a3194295c5677db749
43b7a60c0ef8b4af001f45a0c57410b7374b1d75a6811e0dfc86e4d60f503856
7731a9e1e5fff9d912b1d238dcd92c2ba671a5ea55441bb7f14b05ed40039ce1
794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81
a58864dd006f0528f890c9e000e660f65ffe041ebd2bcb45903fb0228321cfb2
05ba2df0033e3cd5b987d66b6de545df439d338a20165c0ba96cde8a74e463e5
c0a42741eef72991d9d0ee8b6c0531fc19151457a8b59bdcf7b6373d1fe56e02
6584cd273625ee121e330a981cc04e1f1d312356c9cccdb62932ea7aad53a731 da6e60b4e39c6c556836a18a09a52cd83c47f9cf6dc9e3ad298cbcb925a62a96
373a791f058539d72983e38ebe68e98132fcf996d04e9a181145f22a96689386
fc55f8b61cb79f2b85b8bf35ff1b80f49fc61a860aca7729f35449df4928cd9b
0c50992b87ba354a256dfe4356ffa98c8bc5dd231dab0a4dc64413741edb739b 5b7bed7349f6b1499b7eac111d7264101b13eeb9684830a4a93bab5f9d79d77e
be19681b21f2a573b477444a788e00eb8dad2d740d11c02f14e878fe5b89fa70
33203ecb5c34c45dacf64c42c3a24cd4aeb2ceb26b0c58ba97fc8f33319da91b
3b58516758466c8129c4899f07e1e50ca98d913f7c13665aa446c75325b7c5d8
Files and Tools
psscriptpolicytest_im2hdxqi.g0k .ps1
psscriptpolicytest_lysyd03n.o10 .ps1
psscriptpolicytest_1bokrh3l.2nw .ps1
psscriptpolicytest_nvuxllhd.fs4 .ps1
psscriptpolicytest_2by2p21u.4ej .ps1
psscriptpolicytest_te5sbsfv.new .ps1
psscriptpolicytest_v3etgbxw.bmm .ps1
psscriptpolicytest_fqa24ixq.dtc .ps1
psscriptpolicytest_jzjombgn.sol .ps1
psscriptpolicytest_rdm5qyy1.phg .ps1
psscriptpolicytest_endvm2zz.qlp .ps1
psscriptpolicytest_s1mgcgdk.25n .ps1
psscriptpolicytest_xnjvzu5o.fta .ps1
psscriptpolicytest_satzbifj.oli .ps1
psscriptpolicytest_grjck50v.nyg .ps1
psscriptpolicytest_0bybivfe.x1t .ps1
psscriptpolicytest_bzoicrns.kat .ps1
BEACON.PS1
Encoded PowerShell script
PowerShell backdoor
Email Address
keishagrey994@outlook[.]com
Virtual Currency Wallets
a6dedd35ad745641c52d6a9f8da1fb09101d152f01b4b0e85a64d21c2a0845ee
bfacebcafff00b94ad2bff96b718a416c353a4ae223aa47d4202cdbc31e09c92
418748c1862627cf91e829c64df9440d19f67f8a7628471d4b3a6cc5696944dd
bc1qn0u8un00nl6uz6uqrw7p50rg86gjrx492jkwfn
Threat Detection Content
YARA Rule
rule NetMonitor
{
meta:
author = "FBI"
source = "FBI"
sharing = "TLP:CLEAR"
status = "RELEASED"
description = "Yara rule to detect NetMonitor.exe"
category = "MALWARE"
creation_date = "2023-05-05"
strings:
$rc4key = {11 4b 8c dd 65 74 22 c3}
$op0 = {c6 [3] 00 00 05 c6 [3] 00 00 07 83 [3] 00 00 05 0f 85 [4] 83 [3] 00
00 01 75 ?? 8b [2] 4c 8d [2] 4c 8d [3] 00 00 48 8d [3] 00 00 48 8d [3] 00 00 48
89 [3] 48 89 ?? e8}
condition:
uint16(0) == 0x5A4D
and filesize < 50000
and any of them
}
MITRE ATT&CK Tactics and Techniques
Initial Access
Technique Title: External Remote Services
ID: T1133
Use: AvosLocker affiliates use remote system administration tools—Splashtop Streamer, Tactical RMM, PuTTy, AnyDesk, PDQ Deploy, and Atera Agent—to access
backdoor access vectors.
Execution
Technique Title: Command and Scripting Interpreter (PowerShell)
ID: T1059.001
Use: AvosLocker affiliates use custom PowerShell scripts to enable privilege escalation, lateral movement, and to disable antivirus.
Technique Title: Command and Scripting Interpreter (Windows Command Shell)
ID: T1059.003
Use: AvosLocker affiliates use custom .bat scripts to enable privilege escalation, lateral movement, and to disable antivirus.
Technique Title: Windows Management Instrumentation
ID: T1047
Use: AvosLocker affiliates use legitimate Windows tools, such as PsExec and Nltest in their execution.
Persistence
Technique Title: Server Software Component
ID: T1505.003
Use: AvosLocker affiliates have uploaded and used custom webshells to enable network access.
Credential Access
Technique Title: Credentials from Password Stores
ID: T1555
Use: AvosLocker affiliates use open-source applications Lazagne and Mimikatz to steal credentials from system stores.
Command and Control
Technique Title: Protocol Tunneling
ID: T1572
Use: AvosLocker affiliates use open source networking tunneling tools like Ligolo and Chisel.
Tags
Posted on: October 25, 2023
More from Cyware
Stay updated on the security threat landscape and technology innovations at Cyware with our threat intelligence briefings and blogs.
The Virtual Cyber Fusion Suite
