SOC Prime Bias: High

03 Dec 2025 20:12
newspaper icon picussecurity.com

Riddle Spider Avaddon Ransomware Analysis and Technical Overview

Author Photo
Ruslan Mikhalov Chief of Threat Research at SOC Prime linkedin icon Follow
Riddle Spider Avaddon Ransomware Analysis and Technical Overview
shield icon

Detection stack

  • AIDR
  • Alert
  • ETL
  • Query


Summary

Avaddon is a Ransomware-as-a-Service (RaaS) operation run by the criminal group Riddle Spider. The C++-based malware encrypts local and network-accessible data, removes shadow copies, and leverages a double-extortion model by threatening to leak exfiltrated information. It is deployed via stolen credentials, exposed RDP services, and custom web shells, and largely leverages multiple anti-analysis techniques.

Avaddon Ransomware Analysis

The analysis details Avaddon’s code base, how it stores its configuration, performs geographic checks, stops services, terminates processes, and carries out encryption using AES-256 with unique keys per file. It also enumerates the services and processes selected for termination and the specific commands used to disable recovery mechanisms.

Mitigation

Defenders should enforce robust credential hygiene, limit or harden RDP exposure, monitor for known web shell patterns, and detect execution of shadow copy removal commands. Application whitelisting and maintaining regular, offline backups can significantly reduce the ransomware’s impact.

Response

When Avaddon activity is detected, isolate the compromised system, capture volatile evidence, block associated command-line behavior, and initiate incident response with full forensic imaging. Recover data from trusted offline backups and consider involving law enforcement due to the double-extortion tactics.

“`mermaid graph TB %% Class definitions classDef action fill:#99ccff classDef tool fill:#ffcc99 classDef malware fill:#ff9999 classDef process fill:#cccccc %% Nodes action_valid_accounts[“<b>Action</b> – <b>T1078 Valid Accounts</b><br/>Adversary uses stolen or guessed credentials to gain initial access, often via compromised RDP credentials.”] class action_valid_accounts action action_rdp[“<b>Action</b> – <b>T1021.001 Remote Services: Remote Desktop Protocol</b><br/>Use of RDP for lateral movement and remote command execution after obtaining valid credentials.”] class action_rdp action malware_web_shell[“<b>Malware</b> – <b>T1505.003 Server Software Component: Web Shell</b><br/>Deployment of custom web shells (e.g., BLACKCROW, DARKRAVEN) to maintain persistent access and execute commands on compromised servers.”] class malware_web_shell malware action_c2_comm[“<b>Action</b> – <b>T1102.002 Web Service: Bidirectional Communication</b><br/>Web shells provide bidirectional command‑and‑control communication channel.”] class action_c2_comm action tool_powershell[“<b>Tool</b> – <b>T1059.001 Command and Scripting Interpreter: PowerShell</b><br/>Execution of PowerShell scripts via post‑exploitation frameworks such as Empire or PowerSploit.”] class tool_powershell tool action_auto_collection[“<b>Action</b> – <b>T1119 Automated Collection</b><br/>Automated gathering of files and data before exfiltration.”] class action_auto_collection action tool_7zip[“<b>Tool</b> – <b>T1560.001 Archive Collected Data: Archive via Utility</b><br/>Compression of harvested data using 7Zip.”] class tool_7zip tool action_exfil_cloud[“<b>Action</b> – <b>T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage</b><br/>Upload of archived data to cloud services such as MEGAsync.”] class action_exfil_cloud action action_gather_info[“<b>Action</b> – <b>T1592 Host Information Collection</b><br/>Collect hardware, software, firmware, and client configuration details for ransom note preparation.”] class action_gather_info action action_service_stop[“<b>Action</b> – <b>T1489 Service Stop</b><br/>Stopping and deleting security‑related services and processes to avoid interference during encryption.”] class action_service_stop action action_exclusive_control[“<b>Action</b> – <b>T1668 Exclusive Control</b><br/>Gaining exclusive control to delete shadow copies and prevent recovery.”] class action_exclusive_control action action_inhibit_recovery[“<b>Action</b> – <b>T1490 Inhibit System Recovery</b><br/>Disabling recovery mechanisms (vssadmin, wbadmin, bcdedit) and deleting shadow copies.”] class action_inhibit_recovery action action_obfuscation[“<b>Action</b> – <b>T1027 Obfuscated Files or Information</b><br/>Configuration strings are Base64‑encoded and further obfuscated with arithmetic operations.”] class action_obfuscation action action_data_encryption[“<b>Action</b> – <b>T1486 Data Encrypted for Impact</b><br/>Encrypting victim files with AES‑256, using per‑file keys and excluding critical system directories.”] class action_data_encryption action action_hide_artifacts[“<b>Action</b> – <b>T1564.012 Hide Artifacts: File/Path Exclusions</b><br/>Excluding specific directories and extensions from encryption to maintain system stability.”] class action_hide_artifacts action %% Flow connections action_valid_accounts –>|leads to| action_rdp action_rdp –>|enables| malware_web_shell malware_web_shell –>|provides| action_c2_comm action_c2_comm –>|uses| tool_powershell tool_powershell –>|executes| action_auto_collection action_auto_collection –>|feeds| tool_7zip tool_7zip –>|produces archive for| action_exfil_cloud action_exfil_cloud –>|completes| action_gather_info action_gather_info –>|precedes| action_service_stop action_service_stop –>|enables| action_exclusive_control action_exclusive_control –>|leads to| action_inhibit_recovery action_inhibit_recovery –>|sets stage for| action_obfuscation action_obfuscation –>|precedes| action_data_encryption action_data_encryption –>|accompanied by| action_hide_artifacts %% Styling class action_valid_accounts,action_rdp,action_c2_comm,action_auto_collection,action_exfil_cloud,action_gather_info,action_service_stop,action_exclusive_control,action_inhibit_recovery,action_obfuscation,action_data_encryption,action_hide_artifacts action class tool_powershell,tool_7zip tool class malware_web_shell malware “`

Attack Flow

Simulations

Executive Summary

Test Case ID: TC-20251104-A7B9Z
TTPs: T1219, T1566.001
Detection Rule Logic Summary: Detects any email whose subject contains the word “load” and whose body includes both “.exe” and “.msi” strings, indicating a malicious download link.
Detection Rule Language/Format: sigma
Target Security Environment: Windows OS – network connection logs (e.g., Windows Firewall, proxy, DNS logs) – SIEM platform that consumes Sigma rules (e.g., Splunk, Elastic, Azure Sentinel)
Resilience Score (1-5): 2
Justification: The rule relies on…
View Full Simulations

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.

Join for Free