{"id":51925,"date":"2022-01-10T11:37:31","date_gmt":"2022-01-10T07:37:31","guid":{"rendered":"https:\/\/techxmedia.com\/?p=51925"},"modified":"2025-04-18T00:19:46","modified_gmt":"2025-04-17T20:19:46","slug":"sophos-reports-avoslocker-ransomware-uses-anydesk-to-launch-attacks","status":"publish","type":"post","link":"https:\/\/techxmedia.com\/en\/sophos-reports-avoslocker-ransomware-uses-anydesk-to-launch-attacks\/","title":{"rendered":"Sophos reports AvosLocker ransomware uses AnyDesk to launch attacks"},"content":{"rendered":"\n

In the post “AvosLocker Remotely Accesses Boxes, Even Running in Safe Mode,” Sophos published new findings on the AvosLocker malware. Attackers try to get around security controls by employing a combination of Windows Safe Mode and the AnyDesk remote administration application, according to Sophos’ study. While AnyDesk allows continuous remote access, Windows Safe Mode is an IT<\/a> support solution for resolving IT issues that disables most security and IT administration features.<\/p>\n\n\n\n

According to Sophos, AvosLocker is a relatively new ransomware-as-a-service that first appeared in late June 2021 and is rising in popularity. Sophos Rapid Response has witnessed AvosLocker assaults targeting Windows and Linux systems in the Americas, the Middle East, and Asia-Pacific.<\/p>\n\n\n\n

\u201cSophos discovered that\u00a0the Avos\u00a0Locker attackers\u00a0installed\u00a0AnyDesk so it works in Safe Mode, tried to disable the components of security solutions that run in Safe Mode, and then ran the ransomware in Safe Mode. This creates a scenario where the attackers have full remote control over every\u00a0machine\u00a0they\u2019ve set up with\u00a0AnyDesk, while the target organization is likelylocked out of remote access to those computers. Sophos has never seen some of these components used with ransomware, and certainly not together,\u201d said \u00a0Peter Mackenzie, director of incident response at Sophos\u00a0.<\/strong><\/p>\n\n\n\n

He added, \u201cThe message for IT security<\/a> teams facing such an attack is that even if the ransomware fails to run, until they clean every trace of the attackers\u2019 AnyDesk deployment from every impacted machine, they will remain exposed as the attackers have access to their organization\u2019s network and can lock them out again at any time.\u201d<\/p>\n\n\n\n

\u201cThe techniques used by AvosLocker are simple, but very clever. They ensure that the ransomware has the best chance of running in Safe Mode and allow the attackers to retain remote access to the machines throughout the attack,\u201d said Mackenzie.<\/p>\n\n\n\n

He added, \u201cSophos has reported on\u00a0Snatch\u00a0and BlackMatter\u00a0implementing the technique, however, neither of these ransomware groups attempted to install a subsequent application, such as\u00a0AnyDesk, for command and control of the machines while in Safe Mode. We believe we\u2019re seeing this for the first time.\u201d<\/p>\n\n\n\n

TheRansomware Deployment<\/strong>Process<\/strong><\/h3>\n\n\n\n

The core process begins with attackers utilising PDQDeploy to run and execute a batch script called “love.bat,” “update.bat,” or “lock.bat” on targeted devices, according to Sophos experts analysing the ransomware distribution. The script issues and executes a series of commands that prepare the machines for the ransomware’s release before rebooting into Safe Mode.<\/p>\n\n\n\n

The following commands are included in the command sequence, which takes about five seconds to complete:<\/p>\n\n\n\n

\u2022 Attempting to block components of commercial security software solutions that can run in Safe Mode by disabling Windows<\/a> update services and Windows Defender<\/p>\n\n\n\n

\u2022 Setting up the legitimate remote administration toolAnyDesk to run in Safe Mode while connected to the network, allowing the attacker to maintain command and control.<\/p>\n\n\n\n

\u2022 Creating a new user with auto-login credentials, then connecting to the target’s domain controller to remotely access and execute the ransomware executable, update.exe<\/p>\n\n\n\n

Sophos endpoint products, such as\u00a0Intercept X<\/a>,\u00a0protect users by detecting the actions and behaviors of ransomware and other attacks, such as those described in this Sophos research.\u00a0\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"

AvosLocker’s new ransomware-as-a-service first appeared in late June 2021 and is rising in popularity. Sophos Rapid Response has witnessed AvosLocker assaults targeting Windows and Linux systems in the Americas, the Middle East, and Asia-Pacific.<\/p>\n","protected":false},"author":8,"featured_media":51929,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[1595,9621],"tags":[7248,189,3306,801,1695],"contributor":[9732],"class_list":["post-51925","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","category-emerging-technologies","tag-intercept-x-endpoint-protection","tag-it","tag-it-security","tag-ransomware","tag-sophos","contributor-news-desk"],"featured_image_src":"https:\/\/techxmedia.com\/en\/wp-content\/uploads\/2022\/01\/Peter-Mackenzie-director-of-incident-response-Sophos-AvosLocker-ransomware-AnyDesk-techxmedia.jpg","author_info":{"display_name":"Rabab","author_link":"https:\/\/techxmedia.com\/en\/author\/rabab\/"},"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t