AvosLocker Launches Tor Services for Victim Communications and Press Releases
Summary
DarkOwl observed AvosLocker Tor services in July 2021, including a victim negotiation portal, a press-release site listing at least six victims, and an affiliate portal. Analysts said resemblance to DoppelPaymer’s site was not proof of a connection.
Key points
- DarkOwl observed an AvosLocker-branded victim portal where people with an ID from a ransom note could negotiate payment and discuss the status of allegedly extorted data.
- A separate press-release service listed at least six victims in transportation, logistics and legal sectors; DarkOwl withheld their names.
- DarkOwl also observed an affiliate registration and login portal that indicated access required invitation codes.
- Analysts noted the new service resembled DoppelPaymer’s Tor site but said they had no evidence confirming an affiliation or rebrand.
- The article suggested DoppelPaymer’s reduced leak-site activity might indicate a slowdown, but presented this as speculation.
Article Details
- Event Type
- AvosLocker launched a Tor onion service for victim communications and press releases.
- Impact
- The service provided victims with an ID-based portal to negotiate ransom payments and the status of extorted data. DarkOwl observed at least six unnamed victims, including transportation and logistics corporations and legal firms. The article also reports prior Doppelpaymer attacks in Europe that resulted in the death of a healthcare patient in Germany.
Threat Actors
Malware
AvosLockerhave been keeping up with the darknet ransomware community have been anxiously awaiting the debut of AvosLocker’s official Tor service, which will be used as a forum for the ransomware-as-a-service (RaaS) group toDoppelPaymerAccompanying this theory, DarkOwl analysts quickly observed that the AvosLocker’s new service has striking resemblance to other websites established on Tor, more specifically the infamous Doppelpaymer RaaS gang.
Countries
Industries
HealthcareIn December of 2020, the FBI issued a warning against the Doppelpaymer RaaS gang after a series of attacks last fall in Europe resulted in the death of healthcare patient in Germany.Legal– lists at least six victims consisting of a mixture of transportation and logistics corporations and legal firms across the globe.Transportation and Logisticsanonymous network earlier this week – lists at least six victims consisting of a mixture of transportation and logistics corporations and legal firms across the globe.