AvosLocker again takes a leaf from REvil’s page by auctioning stolen data on its site, on top of its double extortion scheme. It is important to note that this was a tactic previously employed by the now defunct REvil. Operators also set up certain drivers to make sure that AnyDesk would run even in safe mode. The attacker restarts the machine, disables certain drivers, and runs on safe mode, thus avoiding certain security measures that are unable to run in this mode. Another key element of AvosLocker is running itself on safe mode as part of its evasion tactics. Using this tool, the operator can manually operate and infect the machine. One of the notable characteristics of AvosLocker campaigns is its use of AnyDesk, a remote administration tool (RAT) to connect to victim machines. It uses the remote administration tool AnyDesk.The following are the key characteristics of AvosLocker: It was first spotted in July 2021 and has since come up with several variants released over time. AvosLocker is another variant that runs on a ransomware-as-a-service (RaaS) model.

Autorun anydesk