AvosLocker ransomware

AvosLocker is an affiliate-run extortion programme that surfaced in mid-2021. Encrypted files on Windows receive .avos or, in later builds, .avos2; the Linux build uses .avoslinux. Each affected folder gets a note called GET_YOUR_FILES_BACK.txt that points to a Tor payment portal and warns that stolen data will be published if the victim stays silent. Affiliates have hit US critical infrastructure and other organisations on Windows machines, Linux servers and ESXi hypervisors, typically using legitimate remote-administration and network tools to move through a network before encrypting. A 2023 joint FBI and CISA advisory documents affiliates copying data out with FileZilla and Rclone and then threatening to leak it on the group's site.

Sources: In-house research

File extensions: .avos, .avos2, .avoslinux

Ransom note filenames: GET_YOUR_FILES_BACK.txt

Decryptor: We checked the public decryptor listings on 2026-10-26 and could not confirm whether one exists.

Data exfiltration risk: Confirmed — A joint FBI/CISA advisory reports affiliates exfiltrating data with FileZilla and Rclone, and the group ran a leak site for victims who refused to pay.

Systems typically targeted: Windows, Linux and VMware ESXi servers

Do this first: Isolate affected hosts and review outbound transfers for Rclone or FileZilla activity, assuming data has already left the network.