Cisco Talos Avos Jun 2022

During C0018, the threat actors used Base64 to encode their PowerShell scripts.

During C0018, AvosLocker was disguised using the victim company name as the filename.

For C0018, the threat actors renamed a Sliver payload to `vmware_kb.exe`.

During C0018, the threat actors used the SoftPerfect Network Scanner for network scanning.

During C0018, the threat actors used WMIC to modify administrative settings on both a local and a remote host, likely as part of the first stages for their lateral movement; they also used WMI Provider Host (`wmiprvse.exe`) to execute a variety of encoded PowerShell scripts using the `DownloadString` method.

During C0018, the threat actors used encoded PowerShell scripts for execution.

During C0018, the threat actors used PDQ Deploy to move AvosLocker and tools across the network.

During C0018, the threat actors downloaded additional tools, such as Mimikatz and Sliver, as well as Cobalt Strike and AvosLocker ransomware onto the victim network.

During C0018, the threat actors exploited VMWare Horizon Unified Access Gateways that were vulnerable to several Log4Shell vulnerabilities, including CVE-2021-44228, CVE-2021-45046, CVE-2021-45105, and CVE-2021-44832.

During C0018, the threat actors used AnyDesk to transfer tools between systems.

AvosLocker has encrypted files and network resources using AES-256 and added an `.avos`, `.avos2`, or `.AvosLinux` extension to filenames.

During C0018, the threat actors used AvosLocker ransomware to encrypt files on the compromised network.

During C0018, the threat actors transferred the SoftPerfect Network Scanner and other tools to machines in the network using AnyDesk and PDQ Deploy.

For C0018, the threat actors acquired a variety of open source tools, including Mimikatz, Sliver, SoftPerfect Network Scanner, AnyDesk, and PDQ Deploy.