Skip to main content
Ransomware Group

Avoslocker

AvosLocker is the ransomware payload of the Avos RaaS group, active from July 2021 to approximately May 2023, targeting education, manufacturing, and healthcare sectors on Windows, Linux, and VMware ESXi environments, with the US accounting for ~72% of victims.

Known victims70

Threat level

MEDIUM

Get an alert if one of your domains is named on a ransomware leak site.

Monitor your domainsFree account · up to 5 monitored targets

Tactics, Techniques & Procedures (TTPs)

CredentialTheft

  • LaZagne
  • Mimikatz
  • XenArmor

DefenseEvasion

  • Avast Anti-Rootkit driver

DiscoveryEnum

  • NirSoft WinLister
  • Nmap
  • SoftPerfect NetScan

Exfiltration

  • FileZilla
  • Gofile[.]io
  • PSCP
  • RClone
  • share[.]riseup[.]net

LOLBAS

  • PsExec
  • WMIC

Networking

  • Chisel
  • Ligolo

Offsec

  • Cobalt Strike
  • Sliver

RMM-Tools

  • AnyDesk
  • Atera
  • PDQ Deploy
  • Splashtop
  • TacticalRMM

Known infrastructure

The following Tor hidden services have been associated with this group:

  • AvosLocker
  • DDOS Protection

These sites are malicious. Open them only from an isolated environment.

0

Check if you’re affected

Look up your domain to see whether it appears on Avoslocker’s victim list.

Try it nowFree⌘K
Try

risk score · threat categories · sources · age · confidence — in one request

Other active ransomware groups

LockBitALPHV BlackcatCL0PPlayBianLianAkiraMedusaRhysida