Avoslocker
| RaaS
AvosLocker is the ransomware payload of the Avos RaaS group, active from July 2021 to approximately May 2023, targeting education, manufacturing, and healthcare sectors on Windows, Linux, and VMware ESXi environments, with the US accounting for ~72% of victims.
Victims
70
First Discovered
2021-06-13
victim
Last Discovered
2023-02-11
victim
Inactive Since
3yrs
more than
Avg Delay
N/A
attack→claim
Infostealer
37.5%
victims with domain
Countries
9
hit
Known Locations (2)
| Favicon | Title | Type | Available | Last Visit | Server Info | FQDN | |
|---|---|---|---|---|---|---|---|
|
DDOS Protection | No | 2026-04-28T07:22:38 |
avosqxh72b5ia23dl5fgwcpndkctuzqvh2iefk5imp3pi5gfhel5klad.onion
|
|||
|
AvosLocker | No | 2026-04-28T07:25:12 |
avosjon4pfh3y7ew3jdwz6ofw7lljcxlbk7hcxxmnxlh5kvf2akcqjad.onion
|
Target
Top 5 Activity Sectors
- Manufacturing 12
- Education 9
- Healthcare 7
- Technology 7
- Business Services 6
Top 5 Countries
-
United States
4
-
Indonesia
1
-
Canada
1
-
China
1
-
Singapore
1
Heatmap
Ransom Notes (1)
Tools Used
| Discovery | RMM Tools | Defense Evasion | Credential Theft | OffSec | Networking | LOLBAS | Exfiltration |
|---|---|---|---|---|---|---|---|
|
NirSoft WinLister
Nmap
SoftPerfect NetScan
|
AnyDesk
Atera
PDQ Deploy
Splashtop
TacticalRMM
|
Avast Anti-Rootkit driver
|
LaZagne
Mimikatz
XenArmor
|
Cobalt Strike
Sliver
|
Chisel
Ligolo
|
PsExec
WMIC
|
FileZilla
Gofile[.]io
PSCP
RClone
share[.]riseup[.]net
|
YARA Rules (2)
Victims (70)
Includes data from Care Tech Holdings PLC (parent holding company, caretech-uk.com) & ByTheBridge.co…
Memtech Acoustical is your 'one-stop' source for acoustic services, noise control and acoustic mater…
Global Mining's Product Catalog is available for download. MINExpo 2012 Please Visit Global Mining P…
Buckeye Packaging offers high-quality custom packaging solutions in a variety of substrates, deliver…
Finance, HR, Corporate files present in data leak We are an exclusive provider for Toro, Cl…
Employees: 1,100 - Revenue: $279.8M - Site: www.cannondesign.com Exfiltrated: 5.7 TB Wastin…
We have more than 100GB Data(Employers Data,CVs,Passports,HR,Confidential files...)…
Publicly traded stock as ULBI. Client information, design, manufacture, financial, accounting, HR an…
Corporate Interiors - Steelcase office furniture - Delaware and Philadelphia Contact Us 1-800-690-91…
LW Group now represents eight (8) luxury automobile brands operating at nine (9) locations within th…
Founded in 1965 and based in Fort McMurray, Canada, Keyano College is a community college meeting bo…
McKenzie Health System (MHS) is a not-for-profit medical and surgical hospital in Sandusky, Mich., w…
Founded in 1995 and headquartered in Wilsonville, Oregon, Avamere Family of Companies is a group of …
https://www.zoominfo.com/c/yldz-entegre/355492210 https://www.dnb.com/business-directory/company…
The Canadian Mental Health Association provides mental health services and support. The Association …
Established in 1972, CHIMBUSCO has since reformed with two major shareholders namely, PetroChina and…
LPA Design is an electronics R&D consulting company with engineering expertise in printed circuit bo…
We have confidential files belonging to all 29000 members including Name, Address, SSN, Telephone, E…
Data Stolen: ~1TB of confidential data were NDA-agreemtents, email-bases, private conversations .msg…
Founded in 1999, CHRISTUS Health an international Catholic, faith-based, not-for-profit health syste…
BLUME GLOBAL INC BLUME GLOBAL INDIA PRIVATE LTD BLUME GLOBAL HONG KONG LIMITED Data Stol…
Cyber Insurance policy leaked in sample. At CPA Mutual, our mission is to provide a qualit…
Livingston is a quality source for rental of all Test Equipment and Equipment Management Services wi…
CR2 is an Irish-owned banking software company which provides mobile, internet and ATM financial ser…
Top quality since 1853: the C. Bechstein name is synonymous with exquisite grand and upright pianos …
Cyberattack at Collège Montmorency: ~8TB personal data has been compromised by AVOSLOCKER. Board…
WILL LEAK ALL DATA SEPTEMBER 1, SAMPLE INCLUDE CONTACT At Garnica, we offer a wide range of plan…
As a financial cooperative, Los Alamos Schools Credit Union provides financial products and services…
stablished in 1947 and headquartered in Mauldin, South Carolina, Mount Vernon Mills is a textiles ma…
ALL Active Directory domain hashes leaked!!! Format: kcm.local\tshiamo.molefe:::13506d75610047a0…
The Brigantine Restaurants are a San Diego favorite for fresh seafood, steaks and chops, friendly an…
1 database, filelist, all email/phone leaked in sample! Everything leak in 2 week Savannah Colle…
Documents include Legal, Financials, passports, licenses Truckslogic Optimiza la logística …
750GB+ of stolen data include contracts, confidential , intellectual property data, and more…
Human Resources, Projects, Documents, and more. If Sunland Asphalt refuses to pay the ransom, every …
samples of: Confidential agreements Military personnel (white house service members) r…
Xybion's Emidence TM platform satisfies our current and evolving future needs with the unique adopti…
Our Lady of the Lake University, founded in 1895 by the Congregation of Divine Providence, is a coed…
At Paul Smith's College, it's about the experience. We are the only four-year institution offering b…
Global IT company with terrible IT security. How can Emtec secure clients when they don't secure the…
The leading manufacturer and distributor of innovative, quality beauty and skin care products for me…
https://www.zeusscientific.com/about Zeus Scientific, Inc. manufactures clinical diagnostic solution…
All company projects includes drawings, contracts, and all details employees social security num…
We downloaded 50GB of internal files from DLS Motors. -- Just 83 years ago, the company Sobera S.A. …
We downloaded about 80 gigabytes of internal school documents, including teacher and student contact…
Website - https://alvac.es Company name: ALVAC S.A. Companies System Administrator trying to…
