Avaddon

Avaddon is a type of malware, specifically ransomware, designed to exploit and damage computer systems. It was notable for its compatibility with older systems such as Windows XP and Windows 2003, distinguishing it from other ransomware like Darkside and Babuk which targeted more modern systems like VMWare ESXi and Synology NAS. In February 2021, the Avaddon operators announced a temporary increase in profit share to 80% following the release of a decryption tool that threatened their operation's profitability. The Avaddon ransomware group had connections within the cybercriminal community, notably with individuals like Kondratiev, also known as "Bassterlord" and "Fisheye," who had ties to other ransomware groups including REvil, RansomEXX, and Avaddon. The Avaddon ransomware group ceased operations on June 11, after which they released decryption keys, effectively shutting down their operation. This action followed a series of measures taken by Russia's government against ransomware operators, including Avaddon, in 2021. Following the shutdown, all decryption keys were sent to Bleeping Computer, an online tech support site, allowing victims to regain access to their encrypted files. In the aftermath of Avaddon's shutdown, the landscape of ransomware groups saw significant changes. Notably, NoEscape emerged as a rebrand of Avaddon, adopting multi-extortion tactics and becoming successful in the process. This shift was part of a broader trend of volatility and transformation among ransomware groups, highlighted by instances like the disruption of Hive ransomware, BlackByte's rebranding to Black Suit, and NoEscape's (formerly Avaddon) exit scam. NoEscape is now considered part of the Royal Ransomware lineage, along with Blackmatter, Hunters International, and Avaddon.