Category: Ransomware, Ransomware-as-a-service (RaaS)
Type: Ransomware, data exfiltration, extortion
Platform: Windows
Variants: Multiple versions, typically delivered via phishing or exploit kits
Damage potential: Encrypts files, steals sensitive data, threatens public exposure, and demands ransom for decryption, which may cause significant financial and operational disruption.
Overview
Avaddon ransomware emerged in early 2019 and gained notoriety around mid-2020 as a highly effective and notorious ransomware family that specializes in encrypting files and stealing sensitive data for extortion. It is known for its double-extortion tactic, where attackers not only encrypt the victim's data but also threaten to publicly release the stolen information if the ransom is not paid.
Cybercriminals typically distribute Avaddon through phishing emails, malicious attachments, or exploit kits. Once the malware gains access to a system, it encrypts files and exfiltrates data, often targeting high-value information to increase the likelihood of a ransom payout. The attackers then demand payment in cryptocurrency for decryption keys and promise (most often falsely) to delete the stolen data to avoid public exposure.
Avadon primarily targets Windows operating systems — it executes methods that are specifically designed to exploit vulnerabilities and operate within the Windows enviroment. Affiliates of the Avaddon RaaS were observed targeting a diverse range of industries globally, including manufacturing, healthcare, government, financial services, education, and retail.
Possible symptoms
Avaddon ransomware can significantly impact system performance and security by encrypting files and stealing sensitive data. One of the clearest symptoms of an Avaddon infection is receiving a ransom note demanding payment for decryption. Apart from the ransom note, other possible symptoms of an Avaddon infection may include:
- Sudden system performance degradation due to encryption processes running in the background.
- Files becoming inaccessible with file extensions changed to those used by Avaddon ransomware.
- Increased CPU and disk usage as the ransomware encrypts large volumes of data.
- Unusual network activity related to data exfiltration, often involving outbound connections to external servers.
- Presence of new, unfamiliar files or ransom notes placed in directories containing encrypted data.
- Inability to access files or applications due to encryption, with prompts demanding a ransom payment.
- Suspicious system behavior or error messages indicating corrupted or missing files.
Sources of the infection
Threat actors typically distribute Avaddon ransomware through:
- Phishing emails containing malicious attachments or links that execute the ransomware when you open or click them.
- Malicious websites that offer deceptive downloads or cracked software bundled with Avaddon ransomware payload.
- Exploit kits that deliver malicious code through vulnerabilities in outdated software or unpatched systems, allowing Avaddon to infiltrate networks without your direct interaction.
- Remote desktop protocol (RDP) brute force attacks for exploiting weak or exposed RDP credentials to gain access to systems and deploy Avaddon ransomware.
- Compromised software downloads from unreliable or suspicious sources, often bundled with Avaddon ransomware for silently infecting your system.
Protection
The best way to protect against Avaddon ransomware is to implement a multi-layered security strategy across your systems and networks. Effective protection measures include:
- Using antivirus and anti-malware software. Install and regularly update reliable security solutions that include detection for ransomware, file-encrypting malware, and other threats targeting Windows environments.
- Regularly updating systems and software. Keep your operating system, applications, and security tools up to date to patch vulnerabilities that Avaddon ransomware may exploit.
- Improving network security. Configure firewalls, intrusion detection systems, and endpoint protection to block suspicious traffic, especially from untrusted or unknown IP addresses, and prevent unauthorized access to critical systems.
- Restricting administrative access. Restrict administrative privileges by enforcing strict access controls, using strong authentication, and limiting access to sensitive systems to authorized users only.
- Disabling unnecessary services. Turn off unused or unnecessary network services, such as file-sharing services, or ports that may expose systems to attack.
- Implementing multi-factor authentication (MFA). Use MFA to secure critical accounts, particularly those with remote access or administrative privileges, to prevent unauthorized access.
- Monitoring system and network activity. Use logging and monitoring tools to detect unusual activity such as unauthorized login attempts, unexpected file changes, or excessive CPU usage, which could indicate a ransomware infection.
- Using trusted cyberprotection tools. NordVPN’s Threat Protection Pro™ can help block malicious websites and prevent the download of harmful files, making it easier to defend against Avaddon ransomware.
- Educating yourself about phishing threats. Since Avaddon is commonly spread through phishing emails, educating yourself on how to recognize phishing attempts and avoiding downloading malicious attachments can help reduce the risk of infection.
Removal of Avaddon ransomware
Here’s how to effectively remove Avaddon ransomware from your system:
- 1.Isolate the infected system from the network to prevent further spread of the ransomware.
- 2.Use trusted antivirus or anti-malware tools to scan for and remove the ransomware and any associated files.
- 3.Check for persistence mechanisms, such as altered startup entries or scheduled tasks, that could allow reinfection.
- 4.If possible, restore the system from a clean backup taken before the infection.
- 5.Update all credentials, particularly those for administrative accounts.
- 6.Monitor the system closely for signs of reinfection or unusual activity.
If issues persist or you cannot fully remove the ransomware, consult cybersecurity experts for further assistance.
