Understanding AVADDON Ransomware and Its Overlaps with Other Families

The rise of ransomware as a lucrative cybercrime activity has led to the proliferation of various families, each with their unique characteristics and tactics. One such family is AVADDON, which gained prominence in 2020 before being shut down by law enforcement authorities. In this article, we will explore the history of AVADDON, its similarities with other ransomware families, and the implications for the RaaS (Ransomware-as-a-Service) business.

The Rise and Fall of AVADDON

AVADDON's activity began in June 2020, and it continued to operate until its shutdown in June 2021. During this period, the threat actor behind the service managed to compromise critical targets, resulting in significant impacts on victim networks and substantial ransom demands. The rapid shut down of AVADDON was likely a response to governments' increasing efforts to combat ransomware operations through new legislation and enhanced law enforcement operations.

Similarities with Other Ransomware Families

Mandiant has observed notable overlaps between AVADDON and other ransomware families, suggesting the possibility of rebranding or repurposing in order to reintroduce itself into the RaaS business. These similarities include tactics such as extortion through shaming victims, threatening to release exfiltrated data, and even distributed denial-of-service (DDoS) attacks.

The Evolution of Ransomware

In recent years, ransomware has become one of the primary sources of income in the cybercrime ecosystem. The RaaS model has lowered the barrier to entry into the cybercrime world, leading to an unprecedented spike in ransomware attacks. This trend is expected to continue as long as criminal actors can monetize their activities.

The AVADDON case study offers valuable insights into the tactics and strategies employed by ransomware operators. As the RaaS business continues to evolve, it is essential for organizations to stay vigilant and proactive in preventing and responding to these attacks. By understanding how ransomware families like AVADDON operate, we can better prepare ourselves against this growing threat.

Create a Free Mandiant Advantage Account

To learn more about the tactics used by ransomware operators and how you can protect your organization, create a free account with Mandiant Advantage. Our resources and expertise will help you stay ahead of the evolving cybercrime landscape.

Crypto locker source code