Avaddon Ransomware Grew from Smiley Spam to RaaS Extortion Before Releasing Keys
Threat Actor Intelligence · 7 sources · Updated 3mo ago · First seen Jun 11, 2021
Avaddon emerged as a ransomware-as-a-service operation that initially spread through a massive phishing campaign using smiley-themed lures such as “Your new photo?” and JavaScript attachments disguised as images. The malware downloaded its payload with PowerShell and BITSAdmin, encrypted files with the .avdn extension, dropped HTML ransom notes, changed desktop wallpaper, and directed victims to Tor-based payment pages. Researchers and vendors linked early distribution to large botnet-driven spam activity and later observed affiliates using additional access methods including exposed RDP, weak VPN credentials, and network vulnerability exploitation.
As the operation matured, Avaddon expanded into multi-extortion, publicly listing victims on a leak site, releasing stolen data, and in some cases adding DDoS pressure while continuously updating its code to evade detection and defeat public decryptors. Reports described anti-analysis features, persistence via scheduled tasks and Run registry keys, deletion of backups and shadow copies, and regional exclusions that avoided CIS-language systems. After becoming one of the most active ransomware threats and drawing warnings from authorities, the group abruptly shut down and released 2,934 decryption keys, which were validated by incident-response firms and used to build a free decryptor for victims.
