Riddle Spider Avaddon Ransomware Analysis and Technical Overview

Summary

Avaddon is a Ransomware-as-a-Service (RaaS) operation run by the criminal group Riddle Spider. The C++-based malware encrypts local and network-accessible data, removes shadow copies, and leverages a double-extortion model by threatening to leak exfiltrated information. It is deployed via stolen credentials, exposed RDP services, and custom web shells, and largely leverages multiple anti-analysis techniques.

Avaddon Ransomware Analysis

The analysis details Avaddon’s code base, how it stores its configuration, performs geographic checks, stops services, terminates processes, and carries out encryption using AES-256 with unique keys per file. It also enumerates the services and processes selected for termination and the specific commands used to disable recovery mechanisms.

Mitigation

Defenders should enforce robust credential hygiene, limit or harden RDP exposure, monitor for known web shell patterns, and detect execution of shadow copy removal commands. Application whitelisting and maintaining regular, offline backups can significantly reduce the ransomware’s impact.

Response

When Avaddon activity is detected, isolate the compromised system, capture volatile evidence, block associated command-line behavior, and initiate incident response with full forensic imaging. Recover data from trusted offline backups and consider involving law enforcement due to the double-extortion tactics.

Simulations

Executive Summary

Test Case ID: TC-20251104-A7B9Z
TTPs: T1219, T1566.001
Detection Rule Logic Summary: Detects any email whose subject contains the word “load” and whose body includes both “.exe” and “.msi” strings, indicating a malicious download link.
Detection Rule Language/Format: sigma
Target Security Environment: Windows OS – network connection logs (e.g., Windows Firewall, proxy, DNS logs) – SIEM platform that consumes Sigma rules (e.g., Splunk, Elastic, Azure Sentinel)
Resilience Score (1-5): 2
Justification: The rule relies on…
View Full Simulations