Avos ransomware group expands with new attack arsenal
Summary: Avos, a ransomware-as-a-service group active since June 2021, gained initial access to a victim's network through an internet-exposed ESXi server on VMware Horizon Unified Access Gateways vulnerable to Log4Shell, with the customer notifying Cisco Talos on March 7, 2022, though activity dated back to Feb. 7, 2022. Attackers used encoded PowerShell with the DownloadString method, deployed Sliver, Mimikatz, Cobalt Strike beacons, the SoftPerfect Network Scanner and PDQ Deploy, and delivered the AvosLocker payload on March 8, while DarkComet samples and cryptocurrency miner artifacts indicated multiple threat actors had compromised the same network.
Why it matters: The inner-transit firewalls that could have limited access to internal infrastructure were not configured, so a single unpatched Log4Shell exposure on an internet-facing gateway was enough for attackers to reach internal servers and encrypt files.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026