Avaddon’s primary goal was simple: make money. They accomplished this through a multi-pronged extortion strategy. Their main tactics included encrypting critical files to disrupt business operations, stealing sensitive data to use as leverage, and launching DDoS attacks against victims to increase pressure and force a ransom payment.

To get inside a network, Avaddon affiliates used a few favorite tricks. They were big fans of phishing and malspam campaigns, often sending emails with malicious JavaScript attachments disguised as images. They also exploited exposed Remote Desktop Protocol (RDP) and vulnerable VPN services to gain initial access. Once inside, they used tools like Cobalt Strike and Mimikatz for lateral movement and credential theft.

The group’s procedures were pretty standard for a RaaS operation. After gaining access, they’d spend days, sometimes weeks, snooping around the network to identify and exfiltrate valuable data. They used legitimate tools like wmic, vssadmin, and bcdedit to delete backups and shadow copies, making recovery a nightmare. Finally, they deployed the ransomware, often at night or over a weekend, to encrypt files across the network.