Avaddon

Avaddon was a financially motivated ransomware-as-a-service (RaaS) operation active from late 2019 until its shutdown in June 2021. It recruited affiliates from cybercriminal forums beginning in 2020 and conducted ransomware and extortion attacks against organizations worldwide, including Australian organizations. The operation used double extortion, encrypting victim environments while stealing data and threatening publication through a leak site. It also adopted DDoS-based pressure tactics, constituting triple extortion in conjunction with encryption and data-leak threats. Avaddon affiliates and operators used phishing campaigns with malicious attachments, including document and script-based lures, as well as compromised or weak credentials for remote-access services such as RDP and VPNs. The malware, developed in C++, incorporated anti-analysis measures, searched local and network-accessible storage for files, prioritized databases, terminated processes that could impede encryption, and deleted backups and shadow copies. It could attempt privilege escalation and establish persistence through scheduled tasks or Windows Run-key mechanisms. Avaddon avoided execution on systems configured with CIS-region language settings, particularly Russian. Following heightened pressure on ransomware operations after the Colonial Pipeline incident, Avaddon announced that it would reduce public recruitment and operate with selected existing affiliates, while claiming restrictions on attacks against government, healthcare, and educational targets. The operation ceased on June 11, 2021, wiped its public infrastructure, and released 2,934 decryption keys. The keys were validated by security researchers and enabled a free decryptor for prior victims. Avaddon is also referred to as Avaddon ransomware.