Loading story…
Avaddon emerged as a ransomware-as-a-service operation that initially spread through a massive phishing campaign using smiley-themed lures such as “Your new photo?” and JavaScript attachments disguised as images. The malware downloaded its payload with PowerShell and BITSAdmin, encrypted files with the .avdn extension, dropped HTML ransom notes, changed desktop wallpaper, and directed victims to Tor-based payment pages. Researchers and vendors linked early distribution to large botnet-driven spam activity and later observed affiliates using additional access methods including exposed RDP, weak VPN credentials, and network vulnerability exploitation.
As the operation matured, Avaddon expanded into multi-extortion, publicly listing victims on a leak site, releasing stolen data, and in some cases adding DDoS pressure while continuously updating its code to evade detection and defeat public decryptors. Reports described anti-analysis features, persistence via scheduled tasks and Run registry keys, deletion of backups and shadow copies, and regional exclusions that avoided CIS-language systems. After becoming one of the most active ransomware threats and drawing warnings from authorities, the group abruptly shut down and released 2,934 decryption keys, which were validated by incident-response firms and used to build a free decryptor for victims.
TTPs, infrastructure, and targeting history in one profile.
16 events from the most recent confirmed update back to the earliest known activity.
After receiving the keys via BleepingComputer, Emsisoft prepared a free decryptor for Avaddon victims, and the keys were validated by Emsisoft and Coveware.
On June 11, 2021, the Avaddon ransomware operation shut down, took its servers and leak site offline, and released 2,934 decryption keys for past victims.
In May 2021, the Australian Cyber Security Centre reported that Avaddon operators demanded an average ransom of 0.73 bitcoin, about $40,000.
At the start of May 2021, both the FBI and the Australian Cyber Security Centre issued alerts about Avaddon's growing number of intrusions.
SentinelOne says Avaddon added Monero as a payment option in February 2021, broadening the cryptocurrency choices available to victims.
Shortly after the Colonial Pipeline attack, Avaddon announced plans to go private and work only with a selected number of affiliates, according to The Record.
After the public decryptors appeared in early 2021, Avaddon changed its encryption model to invalidate them and temporarily raised the affiliate revenue share to 80% for one month as compensation.
In early 2021, Bitdefender released a public decryptor for Avaddon and researcher Javier Yuste published an open-source decryptor, with the tool also distributed through NoMoreRansom.org.
SentinelOne reports that Avaddon added DDoS attacks as an intimidation mechanism in January 2021, extending its pressure tactics beyond encryption and data leaks.
In January 2021, Avaddon expanded compatibility to Windows XP and Windows Server 2003, according to SentinelOne's retrospective analysis.
SentinelOne states that Avaddon added round-the-clock affiliate support via chat and ticketing in August 2020, reflecting maturation of its ransomware-as-a-service operation.
By July 2020, Trend Micro reported Avaddon as a newly observed ransomware family spreading through JavaScript-in-ZIP email attachments, using PowerShell and BITSAdmin to fetch its payload and encrypt files with the .avdn extension.
SentinelOne reports that Avaddon added PowerShell payload-launch capability in late June 2020 as part of its ongoing feature development for affiliates.
Avaddon was distributed in a large-scale phishing/spam campaign using photo-themed lures and ZIP archives containing JavaScript downloaders disguised as JPG files. AppRiver attributed the distribution to the Phorpiex/Trik botnet and reported blocking more than 300,000 malicious emails in a short period.
At the beginning of June 2020, Avaddon emerged publicly as a ransomware-as-a-service/affiliate operation promoted on Russian-speaking underground forums, with rules excluding CIS-country targets and revenue sharing for affiliates.
SentinelOne says Avaddon ransomware was first observed in the wild in February 2020, marking the earliest explicit sighting in the provided references.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 58 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
7 references tracked. Mallory keeps watching after this page renders.
labs.sentinelone.com
Open sourcetherecord.media
Open sourceemsisoft.com
Open sourcewelivesecurity.com
Open sourcetrendmicro.com
Open sourcebleepingcomputer.com
Open sourceblog.trendmicro.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GandCrab grew into one of the most prominent **ransomware-as-a-service (RaaS)** operations by pairing frequent malware updates with a broad affiliate program, exploit-kit distribution, and supporting criminal services such as crypters. Technical analyses found the malware used anti-analysis and anti-recovery features, selective language checks to avoid CIS targets, privilege-escalation exploits in later `5.x` builds, and even a downloader that attempted persistence, Windows Defender and firewall bypasses, removable-drive propagation, and delivery of fresh payloads from hard-coded URLs. Researchers also documented repeated coding mistakes that enabled multiple public vaccines and decryptors, while defenders and projects such as **No More Ransom** helped victims recover files without paying in some cases. The operation also fought an extended defensive battle with South Korean vendor **AhnLab**, repeatedly changing tactics to evade or disable `V3 Lite`, including uninstall automation, service termination, and code injection into `Autoup.exe`, while AhnLab and other vendors countered with kill switches, patches, and blocking methods. GandCrab’s operators announced they were shutting down after claiming enormous profits, but reporting and later law-enforcement action indicated the ecosystem did not simply disappear: a Belarusian affiliate was arrested for allegedly infecting more than 1,000 systems across nearly 100 countries, and researchers noted likely continuity between GandCrab personnel or code and later ransomware activity including **REvil/Sodinokibi**.
Aug 15, 2026
REvil, also known as Sodinokibi and tracked by some researchers as **GOLD SOUTHFIELD**, evolved into one of the most consequential ransomware-as-a-service operations by combining aggressive affiliate-driven intrusions with increasingly sophisticated extortion. Reporting tied the group to multiple access methods including RDP brute force, spam, watering-hole compromises, malvertising, unpatched VPN and RDP systems, and malware such as **IcedID** and **Qakbot**. Researchers also documented how REvil’s malware and ecosystem were reused or repurposed: Secureworks assessed that **LV ransomware** was a modified REvil 2.03 beta with a replaced configuration, while separate reporting linked REvil’s rise to the vacuum left by **GandCrab** and described its shift toward leak-site pressure, targeted credential fields, affiliate tracking, and removal of geographic execution restrictions in later samples. The operation’s most damaging campaign exploited multiple zero-day vulnerabilities in **Kaseya VSA**, abusing the platform’s auto-update mechanism to push ransomware through managed service providers and impact an estimated **1,500 downstream organizations**. Victims included Swedish retailers and dozens of customers served by affected MSPs, prompting Kaseya to shut down SaaS VSA, advise customers to take internet-exposed on-premises servers offline, and work with the FBI. After law-enforcement disruption and arrests, researchers reported revived REvil Tor infrastructure and newly compiled samples in 2022 that appeared to come from source code rather than recycled binaries, with updated keys, payment domains, victim-specific account targeting, and evidence of active development despite one buggy build that renamed files without encrypting them.
Aug 15, 2026
Prometheus emerged as a **Thanos-based ransomware** operation targeting organizations with file encryption, victim-specific extensions, and ransom notes such as `RESTORE_FILES_INFO.txt` and `.hta` variants, while also threatening to leak stolen data through a dedicated extortion site and negotiation portal. Researchers said the group claimed ties to **REvil**, but multiple analyses found no technical evidence to support that assertion, instead linking Prometheus to the leaked Thanos builder and a broader ransomware-as-a-service ecosystem. Reported demands ranged from **$6,000 to $100,000 in Monero**, and the malware was observed terminating backup and security processes, altering services, and disabling protections including **Raccine** to speed encryption and increase pressure on victims. A free **CyCraft decryptor** later offered partial recovery for some Prometheus-encrypted files by brute-forcing the malware's weak tickcount-derived **Salsa20** key generation, a flaw that made decryption feasible when known file structures or magic bytes were available. Its release was followed by the apparent shutdown of Prometheus infrastructure, but closely related **Thanos-derived** strains including **Haron, Spook, and Midas** continued to appear, reusing code, extortion tactics, leak sites, and technical markers such as shared note formats and encryption artifacts. Subsequent reporting tied these families to rebranding and builder reuse rather than a single clear attribution, showing how Prometheus became part of a wider lineage of ransomware operations targeting businesses across multiple sectors and countries.
Aug 15, 2026