One Source to Rule Them All: Chasing AVADDON Ransomware
Mandiant
Written by: Adrian Sanchez Hernandez, Paul Tarter, Ervin James Ocampo
The ransomware-as-a-service (RaaS) model is lowering the barrier of entry into the cybercrime world, causing the number of ransomware attacks we're seeing to spike higher than ever before.
In the last few years, ransomware has become one of the principal sources of income in the cybercrime ecosystem, with increased use of extortion by shaming victims, threatening to release exfiltrated data, and in some cases hitting them with distributed denial-of-service (DDoS) attacks.
This blog post explores activity, similarities and overlaps between multiple ransomware families related to AVADDON ransomware, serving as a case study to understand how ransomware operators think and continue to turn a profit in a constantly evolving cybercrime ecosystem.
Various RaaS services have prevailed in compromising critical targets, leading to major impacts on victim networks and to sizable ransom demands. AVADDON is one of these ransomware services.
The threat actor behind the AVADDON ransomware service started activity in June 2020 and continued operations until June 2021. The service was apparently shut down rapidly—and private encryption keys released—as governments prioritized the fight against ransomware operations with new legislation and increased law enforcement operations.
Mandiant has observed notable overlaps between AVADDON and other ransomware families, indicating the possibility of rebranding in order to reintroduce itself into the RaaS business. Based on the profitability of these operations, it is almost certain that numerous threat actors will continue to conduct ransomware operations.
Victimology
Destructive attacks leveraging AVADDON ransomware have affected a wide variety of industries. Based on publicly named victims on AVADDON’s own blog post and Mandiant’s incident response investigations, we have observed AVADDON impacting industry verticals primarily based in North America, including education, technology, healthcare, financial and government.
Based on open-source data, AVADDON released nearly 3,000 private encryption keys, indicating that targeting is almost certainly broader than directly observed.
Figure 1: Industries impacted by AVADDON ransomware based on publicly named victims
Figure 2: Heatmap of publicly named AVADDON victims by country
AVADDON Ransomware Service
In June 2020, Mandiant reported the Russian-speaking threat actor “Avaddon” advertising the AVADDON ransomware affiliate program (RaaS) on the Russian-speaking forums exploit[.]in and xss[.]is. In March 2021, the threat actor Avaddon posted an update for the AVADDON RaaS to announce the development of AVADDON V2 and later that same year incorporated a DDoS feature designed to pressure victims into paying the ransom.
Figure 3: AVADDON affiliate panel
The AVADDON panel seen in Figure 3, was hosted on a TOR hidden service (.onion domain) and was provided to AVADDON affiliates in order to monitor victims and their payments, track builds, provide a support ticketing system, and view statistics and related news publications. As typical with RaaS operations, AVADDON profits are divided according to their Terms of Service specified by the AVADDON operators, initially structured with 65% profit earned for the affiliate and 35% for the operators of the ransomware service (this is subject of change by the RaaS service). However, this could vary depending on the number of victims per affiliate, meaning that the profit percentage for the affiliate could be higher if the number of intrusions increased considerably.
AVADDON Affiliates
Mandiant identified multiple AVADDON affiliates involved in targeted destructive attacks leveraging AVADDON ransomware.
Figure 4: TTPs seen through AVADDON ransomware incidents
These attacks employed various tactics, techniques, and procedures (TTPs), including:
- Compromised credentials from prior intrusions. In one instance, Mandiant observed evidence of an AVADDON affiliate working with an initial access broker to gain initial foothold in a victim’s environment.
- Custom malware such as BLACKCROW and DARKRAVEN web shells to maintain access and interact with a compromised server.
- Publicly available remote administration tool SYSTEMBC for interacting with compromised hosts.
- Windows Remote Desktop Protocol (RDP) for lateral movement.
- WDigest downgrade attack in conjunction with SHARPDUMP or MIMIKATZ to dump clear-text credentials from memory.
- Open-source frameworks and scripts such as EMPIRE and POWERSPLOIT for post-exploitation activity.
- Windows Scheduled Task for persistence.
- Publicly available scanning tools such as SoftPerfect Network Scanner for internal reconnaissance.
- Publicly available rootkit removal tools such as GMER, PowerTool, and TDSSKiller to disable system protection software.
- ProtonMail service to send and receive data initially at the early stages of the intrusion.
- Publicly available archiving tool 7Zip and cloud storage synchronization tool MEGAsync for data staging and exfiltration.
From the TTPs, Mandiant has observed heavy reliance on open-source and publicly available tooling for different purposes across various stages of the intrusion.
Connecting the Dots
Mandiant continues to observe sophisticated TTPs and increased collaboration between different and specialized threat actors, each playing a particular role within the intrusion operation and has observed previous cases of rebranding where a new ransomware service aligns with another, suggesting collaboration between ransomware operators.
Mandiant has reported on multiple cases of potential rebranding and links between RaaS such as BLACKMATTER and SABBATH ransomware families and reported on the possibility of rebranding on AVADDON as the RaaS shut down.
Threat actors behind a RaaS may choose rebranding for a variety of reasons including fixing operational security flaws and the perception of reducing the risk of law enforcement disrupting their operations.
Mandiant has tracked AVADDON and analyzed its multiple versions along with potential ransomware families with which it shares similarities. In April 2021, Mandiant identified numerous ransomware services advertising in Russian-speaking underground forums, using assorted brands, yet having certain degrees of relations with AVADDON as far back as 2019, as seen in Figure 5.
Figure 5: RaaS activity timeline based on forum activity, reported victims and PE timestamps
Mandiant has observed previous RaaS services operating since 2019 to 2021 connected to AVADDON source code. The variations among these ransomware families show an increase in maturity as the final product is improved in terms of performance and cryptographic functionality.
The timeline of these services and the similarities in the code may be part of the rebuilding process, suggesting collaboration between threat actors or access to a shared source code by multiple threat actors.
MEDUSALOCKER is ransomware that was advertised on the Russian-speaking forum xss[.]is by the threat actor ‘Scourge’ and reported by Mandiant in October 2019. During 2020, the service continued to be active and was updated with new versions of the ransomware. The last activity from the threat actor in the forum was in February 2021.
Ako, also known as MedusaReborn, is ransomware that was initially observed around January 2020. Ako operations continued to be active during 2020 and their last publicly exposed victim was added to their shaming blog in July 2020. Mandiant determined that Ako ransomware shares numerous similarities with MEDUSALOCKER and considers Ako to be a variant of MEDUSALOCKER.
ThunderX is a ransomware that started operating in August 2020 according to PE timestamps and public reports. However, in September 2020, Tesorion released a free decryptor that appears to have interrupted ThunderX operations. Mandiant determined ThunderX and RANZY to be a single malware family due to numerous similarities and code overlap.
RANZY, also known as “Ranzy Locker”, is a ransomware that was advertised on the Russian-speaking forums xss[.]is and exploit[.]in by the threat actor “Ranzycorp” in October 2020. RANZY has impacted multiple victims since late 2020, however, Mandiant did not observe publicly named victims on its shaming blog or activity in these forums in 2021.
AVADDON Ransomware Analysis
AVADDON encrypts files stored locally and on mapped network shares. It stops targeted processes and services prior to encrypting files. Mandiant has observed three major release versions that can be seen in Figure 5, for further detail on differences in encryption methodology, see the section AVADDON Encryption Evolution.
The ransomware contains host reconnaissance capabilities to retrieve the system’s Language Code Identifier (LCID) and keyboard layout (Figure 6) and exits if the following languages are found: Russian, Ukrainian, Tatar (Russian) or Sakha (Russian). This is consistent with one of the mandatory policies to which AVADDON affiliates must adhere: the total prohibition of ransomware operations within the Commonwealth of Independent States (CIS) territory.
Figure 6: Checks against language and keyboard layout passlist; AVADDON will exit if any of the languages are detected
AVADDON operates similarly to other ransomware samples and contains an embedded configuration. AVADDON’s configuration is stored in the form of global stdstring variables that are initialized prior to main as a C++ global initializer. The strings are decoded as they are needed during execution. All configuration encoding is performed using Base64 and multiple iterations of arithmetic operations utilizing a hardcoded single-byte key that varies per binary. Figure 7 is an example python script used for decoding configuration data found in sample hash (MD5:ae663fa3b803d8c23e98373fa3f66d21).
from base64 import b64decode
def decode_string(b64_string):
return ''.join([chr(((x-5)^0xb3)&0xff) for x in b64decode(b64_string)])AVADDON’s execution flow begins by stopping and deleting services and processes that might interrupt its operation (Figure 8). Next, the configuration runs multiple commands that prevent a user from restoring from backup (Table 1). Finally, the ransomware begins its encryption operation by recursively iterating local drives and network shares while avoiding directories (Figure 9) and files with specific extensions (Figure 10).
AVADDON searches the following strings related to virtual machines, backups and antivirus services to stop and delete them:
ccEvtMgr
ccSetMgr
Culserver
dbeng8
dbsrv12
DefWatch
Intuit.QuickBooks.FCS
msmdsrv
QBCFMonitorService
QBIDPService
RTVscan
SavRoam
sqladhlp
SQLADHLP
sqlagent
sqlbrowser
sqlservr
sqlwriter
tomcat6
VMAuthdService
VMnetDHCP
VMUSBArbService
vmware-usbarbitator64
vmware-usbarbitator64
VMwareHostdThe following processes are stopped. The ransomware stores a short-hand form of the full process name, but it does not appear to be used during process identification or termination.
AVADDON deletes the Windows shadow volumes and empties the recycle bin to avoid file recovery. Next, it executes the anti-recovery commands in Figure 9. Finally, to prevent the system from restarting, AVADDON leverages the Windows Restart Manager by adding files actively being encrypted to the Restart Manager registry.
wmic.exe SHADOWCOPY /nointeractive
wbadmin DELETE SYSTEMSTATEBACKUP
wbadmin DELETE SYSTEMSTATEBACKUP -d
bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
vssadmin.exe Delete Shadows /All /QuietThe following directories are excluded from the encryption process and are consistent across different versions of AVADDON.
C:\Windows
C:\Program Files
C:\Users\All Users
C:\Users\Public
C:\Users\user\AppData\Local\Temp
C:\Program Files (x86)
C:\Users\user\AppData
C:\ProgramData
C:\Program Files\Microsoft\Exchange Server
C:\Program Files (x86)\Microsoft\Exchange Server
C:\Program Files\Microsoft SQL Server
C:\Program Files (x86)\Microsoft SQL ServerAdditionally, directories containing the following keywords are excluded.
SYSTEMDRIVE
USERPROFILE
PROGRAMFILES(x86)
ProgramData
Program Files
ALLUSERSPROFILE
AppData
PUBLIC
TMP
Tor Browser
MSOCache
EFIWhen encrypting the filesystem, the following extensions are excluded to ensure the system can be recovered after paying the ransom with the provided decryptor.
.bin
.sys
.ini
.dll
.lnk
.dat
.exe
.drv
.rdp
.prf
.swp
.mdf
.mds
.sqlHost Survey
The ransomware includes a host survey as part of the ransom note. The host survey is comprised of two parts that are separated by a hyphen character and then Base64 encoded. The first part is a plaintext victim id, the second part is an RSA encrypted JSON structure of data containing the fields in Figure 13.
