FBI and CISA Release Update on AvosLocker Advisory

The AvosLocker ransomware leak site has not been seen for months, but the government is providing an update on them based on its investigations as recently as May 2023. In May, DataBreaches reported on the Bluefield College breach by an affiliate of Avos.  Because AvosLocker is RaaS, it’s possible that it is still active but just not using the leak site any more.

Here is the government’s advisory notification:

October 11, 2023:

Today, the Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) released a joint Cybersecurity Advisory (CSA), #StopRansomware: AvosLocker Ransomware (Update) to disseminate known indicators of compromise (IOCs), tactics, techniques, and procedures (TTPs), and detection methods associated with the AvosLocker variant identified through FBI investigations as recently as May 2023.

This release updates the March 17, 2022 joint CSA, Indicators of Compromise Associated with AvosLocker ransomware, released by FBI, CISA, and the Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN). This update includes IOCs and TTPs not included in the previous advisory and a YARA rule developed after analyzing a tool associated with an AvosLocker compromise.

FBI and CISA encourage critical infrastructure organizations to implement the recommendations in the joint CSA to reduce the likelihood and impact of AvosLocker ransomware and other ransomware incidents. For more information, see CISA’s #StopRansomware webpage.