AvosLocker Ransomware Exploits Confluence Servers and Disables Antivirus

AvosLocker ransomware has been actively exploiting vulnerabilities in Confluence servers to deploy its malicious payloads, marking a significant threat to organizations relying on this popular collaboration platform. The ransomware group has been observed leveraging these compromised servers to not only deploy AvosLocker but also Cerber2021 ransomware, indicating a broader strategy of targeting unpatched systems to maximize impact. The AvosLocker group has been particularly innovative in its approach to bypassing security measures. Recent variants of the ransomware have been found using a novel technique to disable antivirus protection. This involves abusing a legitimate driver file, which allows the ransomware to operate undetected by security software. This tactic underscores the increasing sophistication of ransomware groups in evading traditional security defenses. In addition to targeting Confluence servers, AvosLocker has also been focusing on VMware ESXi servers, a critical component in many enterprise environments. By compromising these servers, the ransomware can encrypt virtual machines, causing significant disruption to business operations. This focus on critical infrastructure highlights the group's intent to inflict maximum damage and pressure victims into paying ransoms. The ransomware's capabilities extend beyond mere encryption. AvosLocker variants have been reported to scan for the Log4Shell vulnerability, a critical flaw that has been widely exploited since its disclosure. By identifying and exploiting this vulnerability, the ransomware can gain initial access to systems, further expanding its reach within a network. Organizations in various sectors, including critical infrastructure, have been identified as targets of AvosLocker. The ransomware's operators are known to demand substantial ransoms, often threatening to leak stolen data if their demands are not met. This double extortion tactic has become a hallmark of modern ransomware operations, increasing the pressure on victims to comply. Defenders are advised to ensure that all systems, particularly those running Confluence and VMware ESXi, are fully patched and up to date. Regularly updating antivirus definitions and employing advanced threat detection solutions can help mitigate the risk of infection. Additionally, organizations should conduct thorough security audits to identify and remediate any potential vulnerabilities that could be exploited by ransomware groups. As ransomware continues to evolve, the importance of a proactive and layered security strategy cannot be overstated. Organizations must remain vigilant and prepared to respond to the ever-changing tactics employed by groups like AvosLocker.