AvosLocker is a ransomware family and Ransomware-as-a-Service (RaaS) operation associated with double-extortion activity. The provided content states it emerged in June 2021 and has targeted entities in the United States, Canada, the United Kingdom, and Spain, with a focus on critical infrastructure. Reported initial access vectors include spear-phishing, exploitation of public-facing applications, and compromised RDP credentials. The malware is described as establishing persistence with custom webshells, escalating privileges via credential dumping, and exfiltrating data before encryption. AvosLocker encrypts files and network resources using AES-256 and appends .avos, .avos2, or .AvosLinux extensions; the content also notes systems may be rebooted into Safe Mode with Networking before encryption and that its Linux variant has terminated ESXi virtual machines. Additional observed behaviors include enumerating shared drives on compromised networks, checking system time before and after encryption, hiding its console window via the ShowWindow API, and using obfuscated API calls resolved by checksums. The content further notes defense-evasion and masquerading behaviors, including being disguised as a .jpg file and, in one incident, being disguised using the victim company name as the filename. It is also referenced as a RaaS program advertised on the RAMP cybercrime forum.
