Description Summary
RaaS with CISA advisory AA23-284A; Windows + Linux/ESXi.
Threat Actor
RaaS; Windows + Linux/ESXi encryptors.
Technical Indicators
Encryption Extension
.avos / .avos2 (Windows); .avoslinux (Linux)
Encryption Algorithm
AES-256-CBC + RSA (hybrid)
Ransom Note Name
GET_YOUR_FILES_BACK.txt
Targeted Industries
Cross-sector (per leak-site victim telemetry)
First Seen
~mid-2021
Last Seen
Active (per CISA AA23-284A)
Geographical Location
Global / not publicly profiled
MITRE ATT&CK Matrix
| Tactic | TTP | Technique Name |
|---|---|---|
| Impact x 2 | T1486 | Data Encrypted for Impact |
| T1490 | Inhibit System Recovery | |
| Exfiltration x 1 | T1567 | Exfiltration Over Web Service (leak site) |
| Initial Access x 2 | T1190 | Exploit Public-Facing Application |
| T1078 | Valid Accounts |