Skip to main content
Darkfield

Operator dossier

Avaddon is a ransomware operator no longer publishing new disclosures. Darkfield has indexed 146 public victims claimed by this operator between February 1, 2021 and September 9, 2021. Avaddon is a financially motivated ransomware group that emerged in early 2021, conducting targeted attacks primarily against organizations in the United States, United Kingdom, Germany, Spain, and Australia. The group operated as a Ransomware-as-a-Service (RaaS) model, recruiting affiliates to conduct attacks while the core operators maintained the ransomware infrastructure and negotiated with victims. Avaddon employed double extortion tactics, exfiltrating sensitive data before deploying their encryption payload and threatening to publish stolen information on their leak site if ransom demands were not met. The group typically gained initial access through phishing emails, exploited vulnerabilities in remote access services, and used legitimate administrative tools to move laterally within compromised networks. Over its operational period, Avaddon targeted critical infrastructure sectors including energy, government, finance, manufacturing, and transportation, successfully compromising at least 146 documented victims. The group's activities were significantly disrupted in June 2021 when the operators voluntarily shut down their operations and provided decryption keys for all victims to law enforcement, making Avaddon one of the few ransomware groups to cease operations without direct law enforcement takedown action.

Most-targeted sectors

Most-affected countries

Recent disclosures by Avaddon

All 146 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for Avaddon →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Inactive ransomware operator

← All groups

Avaddon

146 victims indexed · first seen 5 years ago · last activity 5 years ago

146
Victims indexed
#58 of 364 tracked operators
7m
Active period
Feb 2021 → Sep 2021
10
Countries hit
top United States · 32

At a glance

Status
inactive
First seen
5 years ago
Last activity
5 years ago
Onion sites
1 known endpoint
Primary sector
Energy · 4 hits

About

Avaddon is a financially motivated ransomware group that emerged in early 2021, conducting targeted attacks primarily against organizations in the United States, United Kingdom, Germany, Spain, and Australia. The group operated as a Ransomware-as-a-Service (RaaS) model, recruiting affiliates to conduct attacks while the core operators maintained the ransomware infrastructure and negotiated with victims. Avaddon employed double extortion tactics, exfiltrating sensitive data before deploying their encryption payload and threatening to publish stolen information on their leak site if ransom demands were not met. The group typically gained initial access through phishing emails, exploited vulnerabilities in remote access services, and used legitimate administrative tools to move laterally within compromised networks. Over its operational period, Avaddon targeted critical infrastructure sectors including energy, government, finance, manufacturing, and transportation, successfully compromising at least 146 documented victims. The group's activities were significantly disrupted in June 2021 when the operators voluntarily shut down their operations and provided decryption keys for all victims to law enforcement, making Avaddon one of the few ransomware groups to cease operations without direct law enforcement takedown action.

References

42 links

External sources curated by the MISP threat-intel community.

Timeline

5 months
2021-02-01T00:00:00+00:00 · 22021-04-01T00:00:00+00:00 · 12021-05-01T00:00:00+00:00 · 12021-06-01T00:00:00+00:00 · 12021-09-01T00:00:00+00:00 · 141
2021-02-01T00:00:00+00:002021-09-01T00:00:00+00:00

Top countries

🇺🇸 United States
32
🇬🇧 United Kingdom
10
🇩🇪 Germany
4
🇪🇸 Spain
2
🇦🇺 Australia
2
🇵🇹 Portugal
2
🇨🇿 Czech Republic
2
🇵🇱 Poland
1
United States dossier →United Kingdom dossier →Germany dossier →Spain dossier →

Top sectors

Energy
4
Government
3
Finance
3
Manufacturing
3
Transportation
2
Construction
2
Food & Agriculture
2
Government Facilities
2
Energy dossier →Government dossier →Finance dossier →Manufacturing dossier →

MITRE ATT&CK

8 techniques · 7 tactics

Tactics

Initial AccessExecutionDefense EvasionLateral MovementCollectionExfiltrationImpact

Techniques

  • T1566Phishing
  • T1059Command and Scripting Interpreter
  • T1055Process Injection
  • T1112Modify Registry
  • T1021Remote Services
  • T1083File and Directory Discovery
  • T1041Exfiltration Over C2 Channel
  • T1486Data Encrypted for Impact

Recent victims

Loading…

Onion infrastructure

1 known
  • http://avaddongun7rngel.onion

Source

Updated 5 years ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time Avaddon posts a victim.

Add Avaddon to your watchlist — Pro pings you within 5 minutes of any new Avaddon leak-site post, Telegram callout, or affiliate-rebrand inference.