Avaddon ransomware

Avaddon was a ransomware-as-a-service operation first seen in February 2020 and run as an affiliate programme from June 2020. Payloads were written in C++ and combine AES-256 with RSA-2048. Early spam-delivered builds renamed files with .avdn; later builds use a random letter extension unique to each victim and leave an HTML ransom note in each folder whose name starts with the victim ID. The operators closed the programme in June 2021 and handed over their decryption keys, and free tools from Emsisoft and Bitdefender (BDAvaddonDecryptor) now decrypt affected files. Targets were businesses and public bodies on Windows networks, with affiliates barred from attacking CIS countries. Data was stolen before encryption and victims were named on a leak blog, with DDoS attacks threatened against those who did not pay. Avaddon is not a rebrand of an earlier family.

File extensions: .avdn, BBDdaDCAdd, avdn, 1F2jJ, bDacADEEaA, BDdaCEeeEc, bEEAdCACeb, BHGQ, CAcaebBeda, eAEEeEaab, O8lK, rgphB4G0HecPL3qlvf, Vobps, yqJT8NB

Decryptor: A free decryptor is available.