<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hello,
<div><br>
</div>
<div>I hope everyone is doing well!<br>
</div>
<div><br>
</div>
<div>Below is the entry for today.</div>
<div><br>
</div>
<div>12/23/2021 - Diary entry #418:</div>
<div><br>
</div>
<blockquote style="margin-top:0;margin-bottom:0">
<div>AvosLocker is a Ransomware group that first appeared in July 2021. Once executed, it appends the ".avos" extension to the encrypted files and drops a ransom note named "GET_YOUR_FILES_BACK.txt" in every encrypted directory. Its authors advertised in various
underground forums, such as Dread (a popular dark web forum), looking for new affiliates.
<div><br>
</div>
<div>In recent attacks, AvosLocker is rebooting compromised systems into Windows Safe Mode to disable security solutions, allowing it to encrypt all files without being interfered with. This is not a new tactic, since it was already used by Snatch Ransomware
last year, as we covered in our first Daily Diary.</div>
<div><br>
</div>
<div>As soon as AvosLocker operators gain initial access, they use a legitimate deployment tool, named PDQ Deploy, to execute several Windows batch scripts. These scripts modify and delete Registry keys that belong to specific endpoint security tools. They
also create a new user account, adding it to the Administrators user group. Next, they configure that account to automatically log in when the system reboots into Safe Mode. Once it's rebooted, the ransomware payload is executed from a Domain Controller location.</div>
<div><br>
</div>
Our team monitors AvosLocker's wall-of-shame, a dark web blog where they publish stolen data from victims that refused to pay the ransom. So far, there are 49 victims shown there since July 13, including Gigabyte Inc. and Pacific City Bank (covered in our Daily
Diary #366). Using this new tactic, AvosLocker will certainly increase its number of victims.<br>
</div>
</blockquote>
<div><br>
</div>
Merry Christmas and Kind Regards,<br>
</div>
<div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<div>
<div></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<table style="font-size:medium; font-family:"Times New Roman"">
<tbody>
<tr>
<td style="width:180px" align="left">
<table width="120" align="left">
<tbody>
<tr>
<td colspan="3" align="center"><a href="https://www.appgate.com/" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="margin:0px" width="120" height="30" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/logo@2x.png"></a></td>
</tr>
<tr>
<td colspan="3" align="center"> </td>
</tr>
<tr>
<td width="37%" align="center"><a href="https://www.linkedin.com/company/appgate-security/" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="margin:0px" width="18" height="18" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/likedin@2x.png"></a></td>
<td width="28%"><a href="https://twitter.com/AppgateSecurity" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="margin:0px" width="20" height="18" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/twitter@2x.png"></a></td>
<td width="35%"><a href="https://www.youtube.com/channel/UC-8GvxcZbm-R3EJNl8jYjiQ" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="margin:0px" width="26" height="18" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/youtube@2x.png"></a></td>
</tr>
</tbody>
</table>
<p style="margin-top:0px; margin-bottom:0px"> </p>
</td>
<td colspan="2" rowspan="2" style="width:350px">
<p style="color:rgb(12,12,12); font-size:13px; font-family:Arial,Helvetica,sans-serif; margin-top:0px; margin-bottom:0px">
<strong>Felipe Tarijon de Almeida</strong><br>
Malware Analyst<br>
<strong>Appgate</strong></p>
<p style="color:rgb(12,12,12); font-size:13px; font-family:Arial,Helvetica,sans-serif; margin-top:0px; margin-bottom:0px">
E:<span style="margin:0px"> <a href="mailto:felipe.tarijon@appgate.com" title="mailto:felipe.tarijon@appgate.com">
felipe.tarijon@appgate.com</a></span><br>
O:<span> </span><span style="margin:0px; background-color:white">+55 11 97467 9549</span></p>
</td>
</tr>
</tbody>
</table>
<br>
</div>
</div>
</div>
</div>
</body>
</html>