Ongoing campaign using Avaddon Ransomware - 2021-003:

Background

Avaddon is a ransomware variant first detected in February 2019, used in cybercriminal campaigns targeting multiple sectors and organisations around the world, including Australia. Avaddon is offered as a Ransomware-as-a-Service (RaaS), enabling affiliates to utilise it as desired, provided they return a percentage of profits to Avaddon developers as commission. The ACSC is aware of several instances where the Avaddon ransomware has directly impacted organisations within Australia.

Dark Web and Threat Activity

Avaddon has an active presence on underground dark web cybercrime forums, notably advertising the Avaddon RaaS variant to potential affiliates via a number of high tier cybercrime forums. Avaddon threat actors also utilise the data leak site (DLS) avaddongun7rngel[.]onion to identify victims who fail or refuse to pay ransom demands.

Avaddon threat actors demand ransom payment via Bitcoin (BTC), with an average demand of BTC 0.73 (approximately USD $40,000) with the lure of a decryption tool offered (‘Avaddon General Decryptor’) if payment is made.

Targeted Countries and Sectors

The ACSC is aware of active targeting of the following countries and sectors:

Techniques, Tools, and Procedures

Identified Techniques, Tools and Procedures (TTPs) for Avaddon threat actors include:

• Using phishing and malicious email spam (malspam) campaigns to deliver malicious JavaScript files. These are often low in sophistication, containing a threat suggesting the attached file contains a compromising photo of the victim.
• Using ‘double extortion’ techniques as coercion and further pressure to pay a ransom including:
• Threatening to publish the victim’s data (via the Avaddon Data Leak Site (DLS): avaddongun7rngel[.]onion
• Threatening the use of DDoS attacks against the victim (identified since February 2021)
• Applying the GetUserDefaultLCID() function to identify the default geolocation and system language of the user’s device, subsequently, determining whether the user will be targeted for attack, or not. This technique has also been observed in ransomware campaigns using the MedusaLocker variant.
• TTPs for Avaddon are very similar to those identified in use within the Ako and MedusaLocker ransomware variants, including the use of an embedded public key to perform AES-256 encryption on all file data, as well as using a Windows Scheduled Task to establish persistence.

Malware Capabilities

The Avaddon ransomware has the following capabilities:

MITRE ATT&CK

Mitigations

The ACSC has published several products which can assist organisations in reducing the risk and impact of ransomware. These products can be found on the ACSC website.

The ACSC also recommends the following be implemented:

• Patch operating systems and applications, and keep antivirus signatures up to date.
• Scan emails and attachments to detect and block malware, and implement training and processes to identify phishing and externally-sourced emails.
• Maintain offline, encrypted backups of data and regularly test your backups. Regularly conduct backup procedures and keep backups offline or in separated networks.

Indicators of Compromise

SNORT Alert

Snort IDS: 2007837 ET TROJAN Suspicious User-Agent - Possible Trojan Downloader (WinInet)

YARA Rules

SHA256 Hashes