Avaddon

Avaddon is a Windows ransomware family and ransomware operation active in large-scale criminal campaigns from at least 2020 through 2021. It became especially notable for high-volume email distribution activity and later for intrusions that increasingly relied on remote access services such as RDP and VPN infrastructure rather than direct email delivery. Avaddon has also been linked to use of criminal anonymity infrastructure such as First VPN Service for reconnaissance and intrusion support.

Avaddon is associated with common big-game ransomware tradecraft. It performs locale and keyboard-layout checks to avoid infecting systems associated with Commonwealth of Independent States countries, a pattern frequently seen in Russian-speaking cybercrime ecosystems. On compromised Windows systems it modifies the registry for persistence and user account control bypass, attempts to identify and stop anti-malware products, and uses native administrative tooling to impair recovery by deleting backups and shadow copies, including via WMIC. Execution has been observed through a malicious JScript downloader, and historical reporting also ties Avaddon to major malspam campaigns.

The malware targets Windows environments and is relevant across enterprise victims, with reporting connecting the broader operation to attacks affecting businesses and other organizations. Avaddon is widely recognized as a ransomware family, and later ransomware activity such as NoEscape has been assessed by some researchers as a likely rebranding or descendant of Avaddon.