AvosLocker

Akira ransomware scum blocked victim's security tools - and broke their own encryptor

An Akira ransomware affiliate breached a victim through a SonicWall SSL VPN account that lacked MFA after a credential-spraying attempt, then used RDP and Active Directory enumeration to map the environment, collect data, and stage exfiltration. Huntress reported the attacker created AdUsers.txt and AdComp.txt with PowerShell-based AD dumps, used WinRAR to package files, s5cmd to move data to S3, and installed AnyDesk for persistent remote access and payload delivery before launching the Akira encryptor. The intrusion’s notable defense-evasion step was forcing a compromised Windows host to reboot into Safe Mode with Networking, a technique tracked by MITRE ATT&CK as T1688, to disable endpoint protections while preserving connectivity. In Safe Mode, the Huntress agent and Microsoft Defender real-time protection were suppressed, but the Akira encryptor appears to have hit virtual-memory errors and failed to complete encryption; Defender later detected akira.exe yet could not quarantine it until the system returned to normal mode. Researchers warned the failure was accidental rather than protective, and urged organizations to enforce MFA on VPN access and monitor for failed VPN login bursts, Safe Mode boot changes, and unexpected security-service stoppages.

Akira Hits Safe Mode: Ransomware Rebooting Around EDR | Huntress

Safe Mode Boot, Technique T1688 - Enterprise | MITRE ATT&CK®

Multi-Platform SMAUG RaaS Aims To See Off Competitors - SentinelLabs

SMAUG is a ransomware-as-a-service (RaaS) operation that advertises 64-bit payloads for Windows, Linux, and macOS, positioning itself as a multi-platform option for affiliates. The service reportedly charges a 20% affiliate fee plus a 0.2 BTC registration fee, and provides a web-based campaign builder, customizable ransom demands, offline encryption, and a "Company Mode" that allows a single decryption key to unlock multiple systems inside one targeted organization. Victims are directed to a Tor-based payment portal, while operators reportedly offer automated support for both affiliates and victims and bar attacks against CIS countries. On Windows, SMAUG uses obfuscated Go binaries that gather system details and stored browser credentials, establish persistence through Registry Run Keys consistent with MITRE ATT&CK T1547.001, and then encrypt files for impact using AES-256 with keys protected by RSA-2048, aligning with T1486 Data Encrypted for Impact tradecraft. The combination of credential collection, registry-based autostart, and hybrid cryptography reflects a mature ransomware model designed to support repeatable intrusions and broad enterprise targeting across multiple operating systems.

Kasseika Ransomware Deploys BYOVD Attacks Abuses PsExec and Exploits Martini Driver | Trend Micro (US)

Trend Micro reported that the Kasseika ransomware used a bring-your-own-vulnerable-driver (BYOVD) technique to compromise Windows environments, disable security tools, and encrypt victim files. In the investigated intrusion, the attackers reportedly gained initial access through targeted phishing, then used remote administration tools and PsExec for execution and lateral movement. The malware abused the signed but vulnerable Martini.sys driver from TG Soft’s VirIT Agent System to terminate antivirus and analysis processes, allowing the ransomware to run with reduced interference. The operation also employed anti-analysis checks, cleared Windows event logs, and deleted shadow copies before encrypting files with ChaCha20 and RSA through CryptoPP. After encryption, Kasseika dropped ransom notes and changed the victim’s desktop wallpaper. Researchers said the malware shares multiple code and behavioral traits with BlackMatter, including ransom note naming conventions and apparent source-code overlap, indicating the operators may have obtained or reused parts of BlackMatter’s codebase.

Lexfo's security blog - AvosLocker Ransomware Linux Version Analysis

AvosLocker, a ransomware-as-a-service operation first identified targeting Windows systems, expanded to Linux with an ELF-based variant designed to hit VMware ESXi servers and disrupt virtualized environments. Reporting on the malware shows it was distributed through spam campaigns and exploitation of Microsoft Exchange ProxyShell-related flaws, then paired encryption with data theft and victim extortion through Tor-based leak sites and an affiliate program. The Linux strain, often called Avoslinux, accepts command-line parameters for thread count and target directories, checks for ESXi-related paths, and attempts to stop running virtual machines before encrypting files and appending the .avoslinux extension. Technical analyses describe the Linux payload as a comparatively simple binary that prioritizes VM-related files such as .vmdk and .vmem, can invoke esxcli to kill active VMs, and may encrypt nearly all files on a host, including system files. Researchers found that the Linux variant uses embedded elliptic-curve cryptography with per-file symmetric keys and encrypted metadata appended to each file, while the Windows branch uses different routines including multithreading, network share enumeration, exclusion logic, and encryption that appends the .avos2 extension before dropping a ransom note. The combined findings show AvosLocker deliberately adapted its tooling to maximize impact against both traditional Windows networks and ESXi-based virtualization infrastructure.

AvosLocker Ransomware Behavior Examined on Windows & Linux | Qualys

AvosLocker - Modern Linux Ransomware Threats - VMware Security Blog - VMware