How to Deal with an Avaddon Ransomware Attack

Avaddon ransomware, a Ransomware-as-a-Service (RaaS) platform, combines data encryption with theft and extortion. Emerging in 2019, Avaddon became notably aggressive by June 2020. Affiliates of the service have targeted a broad range of organisations globally through spam and phishing campaigns, often embedding malicious JavaScript files.

When an organisation falls victim to Avaddon ransomware, they face not only data encryption but also threats of public data leaks and potential distributed denial of service (DDoS) attacks designed to compel ransom payments.

Immediate Actions: Contain and Neutralize

1. Assess the Attack: Determine if the attack is ongoing. If active, identify and isolate affected devices immediately. This can be done by unplugging network cables or disabling Wi-Fi. For widespread impact, consider isolating entire network segments at the switch level.
2. Evaluate Damage: Identify affected endpoints, servers, and operating systems. Check if backups are intact or compromised. Secure an offline copy of any intact backups. Determine which machines remain unaffected, as these will be crucial for recovery.
3. Incident Response Plan: If a comprehensive incident response plan is lacking, quickly establish one. Assemble a team including IT admins, senior management, external security experts, cyber insurance contacts, and legal counsel. Consider reporting the incident to law enforcement and data protection authorities. Communicate with users and customers about the incident carefully, avoiding normal communication channels that attackers might monitor.

Next Steps: Investigate

After containment, conduct a thorough investigation to prevent future incidents. Specialist incident response and threat hunting services can be invaluable here.

1. Infiltration Duration: Attackers often dwell in networks for days or weeks before launching ransomware. They use this time to explore the network, steal valuable data, and maximise disruption.
2. Initial Access Methods: Common entry points include spam campaigns with malicious JavaScript, exposed RDP services, and vulnerable VPNs. Tools like Shodan.io can help identify potential vulnerabilities in your network.
3. Compromised Accounts: Attackers aim to secure domain admin accounts and other critical accounts. Tools like Mimikatz are used to steal credentials and escalate privileges.
4. Network Scanning: Attackers map out network assets, including servers, endpoints, and backup locations, to maximise their impact.
5. Backdoors and Persistence: Attackers install backdoors to maintain access and control over the network, using tools like Cobalt Strike and AnyDesk.
6. Data Exfiltration: Before launching ransomware, attackers often exfiltrate sensitive data using tools like WinRar and cloud storage services like Mega.nz.
7. Targeting Backups: Attackers may attempt to encrypt, delete, or disable backups. Offline backups are essential for recovery.
8. Disabling Security: Attackers try to identify and disable security solutions. Local security management consoles are particularly vulnerable.
9. Timing of Attack: Ransomware deployment often occurs during off-hours to avoid detection, with file encryption taking hours to complete.
10. Post-Attack Monitoring: Attackers may continue monitoring the network after the ransomware is deployed, looking for recovery efforts or planning additional attacks.
11. Extortion Tactics: Besides encryption, attackers may threaten to leak stolen data on sites like avaddongun7rngel[.]onion unless a ransom is paid.

Proactive Measures

1. 24/7 Network Monitoring: Identify and respond to early signs of an attack.
2. Secure RDP Access: Disable internet-facing RDP or place it behind a VPN with Multi-Factor Authentication (MFA).
3. Employee Training: Educate employees about phishing and malicious spam.
4. Regular Backups: Follow the 3-2-1 backup rule (three copies, two different systems, one offline).
5. Advanced Security Solutions: Use solutions with cloud-hosted management consoles, MFA, and Role-Based Administration.
6. Layered Security Approach: Implement defence-in-depth strategies across all endpoints and servers.
7. Incident Response Plan: Regularly update and test your incident response plan, seeking external expertise if necessary.

Conclusion

Handling a cyberattack like Avaddon ransomware is a complex and stressful process. Beyond addressing the immediate threat, it is critical to identify the attack’s entry points, learn from any security lapses, and enhance your defenses to prevent future incidents. This comprehensive approach is essential to safeguard your organisation from recurring attacks.