Avos Locker Ransomware Behavior Examined on Windows & Linux | Qualys
Summary: AvosLocker, a ransomware-as-a-service operation first spotted in late June 2021, has added a Linux variant that targets VMware ESXi virtual machines and can kill running ESXi VMs. The Windows version appends ".avos" or ".avos2" extensions and uses RSA plus ChaCha20, while the Linux version appends ".avoslinux" and uses AES and elliptic-curve cryptography, with both dropping ransom notes directing victims to TOR payment sites.
What's compelling: AvosLocker's ESXi capability lets it kill virtual machines outright, and Cyble research ties the group to exploitation of Microsoft Exchange flaws including CVE-2021-34473 and CVE-2021-31207 via ProxyShell - so an unpatched Exchange server can be the entry point to a wiped virtual estate.