RIDDLE SPIDER

Also known as: Avaddon Team, RIDDLE SPIDER, Riddle Spider

According to Crowdstrike, RIDDLE SPIDER is the operator behind the avaddon ransomware

🌍 Country ["[Unknown]"]

Associated Operations

2020-06 2020-07 2020-08 2021-01 2021-02 2021-04 2021-05 2021-06 Another ransomware now uses DDoS attacks to force victims to pay Avaddon ransomware fixes flaw allowing free decryption Avaddon ransomware launches data leak site to extort victims Avaddon ransomware shows that Excel 4.0 macros are still effective Avaddon ransomware shuts down and releases decryption keys Cyber-attackers hold PN to ransom with major data leak threat Insurer AXA hit by ransomware after dropping support for ransom payments New Avaddon Ransomware launches in massive smiley spam campaign https://timesofmalta.com/articles/view/cyber-attackers-hold-pn-to-ransom-with-major-data-leak-threat.865968 https://www.bleepingcomputer.com/news/security/another-ransomware-now-uses-ddos-attacks-to-force-victims-to-pay/ https://www.bleepingcomputer.com/news/security/avaddon-ransomware-fixes-flaw-allowing-free-decryption/ https://www.bleepingcomputer.com/news/security/avaddon-ransomware-launches-data-leak-site-to-extort-victims/ https://www.bleepingcomputer.com/news/security/avaddon-ransomware-shows-that-excel-40-macros-are-still-effective/ https://www.bleepingcomputer.com/news/security/avaddon-ransomware-shuts-down-and-releases-decryption-keys/ https://www.bleepingcomputer.com/news/security/insurer-axa-hit-by-ransomware-after-dropping-support-for-ransom-payments/ https://www.bleepingcomputer.com/news/security/new-avaddon-ransomware-launches-in-massive-smiley-spam-campaign/

Introduction

According to Crowdstrike, RIDDLE SPIDER is the operator behind the avaddon ransomware

Activities and Tactics

Country of Origin: 🏳️ [“[Unknown]”]

Notable Campaigns

  • 2020-06
  • 2020-07
  • 2020-08
  • 2021-01
  • 2021-02
  • 2021-04
  • 2021-05
  • 2021-06
  • Another ransomware now uses DDoS attacks to force victims to pay
  • Avaddon ransomware fixes flaw allowing free decryption
  • Avaddon ransomware launches data leak site to extort victims
  • Avaddon ransomware shows that Excel 4.0 macros are still effective
  • Avaddon ransomware shuts down and releases decryption keys
  • Cyber-attackers hold PN to ransom with major data leak threat
  • Insurer AXA hit by ransomware after dropping support for ransom payments
  • New Avaddon Ransomware launches in massive smiley spam campaign
  • https://timesofmalta.com/articles/view/cyber-attackers-hold-pn-to-ransom-with-major-data-leak-threat.865968
  • https://www.bleepingcomputer.com/news/security/another-ransomware-now-uses-ddos-attacks-to-force-victims-to-pay/
  • https://www.bleepingcomputer.com/news/security/avaddon-ransomware-fixes-flaw-allowing-free-decryption/
  • https://www.bleepingcomputer.com/news/security/avaddon-ransomware-launches-data-leak-site-to-extort-victims/
  • https://www.bleepingcomputer.com/news/security/avaddon-ransomware-shows-that-excel-40-macros-are-still-effective/
  • https://www.bleepingcomputer.com/news/security/avaddon-ransomware-shuts-down-and-releases-decryption-keys/
  • https://www.bleepingcomputer.com/news/security/insurer-axa-hit-by-ransomware-after-dropping-support-for-ransom-payments/
  • https://www.bleepingcomputer.com/news/security/new-avaddon-ransomware-launches-in-massive-smiley-spam-campaign/

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

  • Avaddon:

Attribution and Evidence

Country of Origin: [“[Unknown]”] Additional attribution information pending cataloguing.

References

References pending cataloguing.