Avaddon

First seen

2020-06-01 00:00:00

Malware type

ransomware

Family

Malware family

Operating systems

windows

Related IoCs

13 (11 malicious)

Last IoC activity

2026-09-02 02:36:15

Profile updated

2026-07-07 12:58:07

Targeted industries: financial-services healthcare-and-pharmaceutical professional-services retail-and-hospitality technology-and-telecommunications

Context

Avaddon is ransomware written in C++ that has been offered as Ransomware-as-a-Service (RaaS) since at least June 2020.

Recent IoC activity

11 malicious indicators in Maltiverse are attributed to Avaddon (S0640). The 11 most recently updated:

Detection coverage

• 2 YARA rules
• 596 Sigma rules

Malware & tools used

• System Language Discovery (attack-pattern)
• Deobfuscate/Decode Files or Information (attack-pattern)
• Service Stop (attack-pattern)
• JavaScript (attack-pattern)
• File and Directory Discovery (attack-pattern)
• Disable or Modify Tools (attack-pattern)
• Native API (attack-pattern)
• Process Discovery (attack-pattern)
• Inhibit System Recovery (attack-pattern)
• Bypass User Account Control (attack-pattern)
• Network Share Discovery (attack-pattern)
• Windows Management Instrumentation (attack-pattern)
• Data Encrypted for Impact (attack-pattern)
• Modify Registry (attack-pattern)
• Obfuscated Files or Information (attack-pattern)
• Registry Run Keys / Startup Folder (attack-pattern)
• System Network Configuration Discovery (attack-pattern)

Detection rules

• MALPEDIA_Win_Avaddon_Auto (yara-rule)
• DITEKSHEN_MALWARE_Win_Avaddon (yara-rule)

Reports & references

• CrowdStrike — Report2021Gtr (report)
• CrowdStrike — Big Game Hunting On The Rise Again According To Ecrime Index (report)
• CrowdStrike — How Big Game Hunting Ttps Shifted After Darkside Pipeline Attack (report)
• docs.google.com — 1Mi8Z2Tbhmqq5X8Wf Ozv3Dvjz5Sjos 3 (report)
• ke-la.com — How Ransomware Gangs Find New Monetization Schemes And Evolve In Marketing (report)
• news.sophos.com — The Ransomware Threat Intelligence Center (report)
• public.intel471.com — Ransomware As A Service 2020 Ryuk Maze Revil Egregor Doppelpaymer (report)
• Broadcom/Symantec — The Ransomware Threat September 2021 (report)
• therecord.media — Darkside Ransomware Gang Says It Lost Control Of Its Servers Money A Day After Biden Threat (report)
• vulnerability.ch — Ransomware And Date Leak Site Publication Time Analysis (report)
• coveware.com — Ransomware Attack Vectors Shift As New Software Vulnerability Exploits Abound (report)
• cronup.com — De Ataque Con Malware A Incidente De Ransomware (report)
• cyborgsecurity.com — Hunting Ransomware Inhibiting System Backup Or Recovery (report)
• hornetsecurity.com — Leakware Ransomware Hybrid Attacks (report)
• pwc.co.uk — What Is Behind Ransomware Attacks Increase (report)
• splunk.com — Gone In 52 Seconds And 42 Minutes A Comparative Analysis Of Ransomware Encryption Speed (report)
• splunk.com — An Empirically Comparative Analysis Of Ransomware Binaries (report)
• zdnet.com — The Malware That Usually Installs Ransomware And You Need To Remove Right Away (report)
• medium.com — W4 Jan En Story Of The Week Ransomware On The Darkweb 7595544363B1 (report)
• Mandiant — Chasing Avaddon Ransomware (report)
• heimdalsecurity.com — Avaddon Ransomware (report)
• atos.net — Avaddon Ransomware Analysis (report)
• acronis.com — Avaddon Ransomware (report)
• cyber.gov.au — 2021 003%20Ongoing%20Campaign%20Using%20Avaddon%20Ransomware%20 %2020210508 (report)
• arxiv.org — 2102.04796 (report)

External references

• mitre-attack — S0640
• Awake Security Avaddon
• Arxiv Avaddon Feb 2021
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy