LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0640: Avaddon

Avaddon is ransomware written in C++ that has been offered as Ransomware-as-a-Service (RaaS) since at least June 2020.[1][2]

EnterpriseS0640MalwareObject v1.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

Avaddon is a Windows ransomware family described by ATT&CK as C++ ransomware offered as ransomware-as-a-service since at least June 2020. The useful defensive lesson is not just “ransomware exists,” but that the mapped behaviors span discovery, execution, persistence, privilege escalation, defense impairment, recovery inhibition, service stopping, and data encryption. For leaders, this makes Avaddon a good coverage test for whether the organization can detect and contain ransomware activity before business-critical files, services, and recovery options are affected.

Executive priority

Prioritize Avaddon as a ransomware readiness scenario for Windows estates. It connects directly to operational resilience: can the business see discovery of systems and shares, unauthorized execution paths such as WMI or scripting, registry-based persistence or modification, attempts to impair tools, service stoppage, recovery inhibition, and eventual file encryption? Executives should ask for evidence that backups and recovery controls are protected, endpoint and Windows telemetry are retained, and incident responders have playbooks for rapid isolation and service restoration.

Technical view

SOC and IR teams should validate detections across the mapped ATT&CK relationships: System Network Configuration Discovery, Process Discovery, File and Directory Discovery, Network Share Discovery, WMI execution, JavaScript execution, Native API activity, Registry modification, Run Key or Startup Folder persistence, UAC bypass indicators, system language checks, obfuscation/deobfuscation behaviors, disabling or modifying tools, service stops, recovery inhibition, and data encryption for impact. Because ATT&CK provides no official detection text for Avaddon, coverage should be tested behaviorally rather than relying on a single malware signature.

Likely telemetry

  • Windows endpoint process creation and command-line telemetry
  • WMI activity logs and remote/local management execution evidence
  • Windows Registry auditing for Run Keys, Startup Folder references, and suspicious modification
  • File system telemetry for large-scale file enumeration, modification, and encryption-like activity
  • Network share and SMB access telemetry

Detection direction

  • Build behavior-based correlation around discovery followed by execution, registry changes, service disruption, recovery inhibition, and file encryption activity on Windows hosts.
  • Treat WMI and scripting alerts carefully: both are legitimate administration mechanisms, so tune around unusual parent processes, destinations, user context, timing, and sequence with discovery or impact behaviors.
  • Validate visibility into registry persistence and registry modification; many ransomware investigations fail when endpoint telemetry does not preserve before-and-after registry state.
  • Confirm that security-tool tamper or service-stop events create high-priority alerts, especially when followed by file share enumeration or bulk file changes.
  • Test whether network share discovery and file/directory enumeration are visible from endpoints and from network or file server logs, since ransomware impact often extends beyond the initially infected host.

Mitigation priorities

  • Harden and monitor Windows administrative surfaces such as WMI, scripting hosts, service control, and registry modification according to least-privilege principles.
  • Protect recovery paths first: maintain resilient backups, restrict access to backup administration, and monitor for changes to recovery mechanisms or shadow-copy-related controls.
  • Limit ransomware blast radius through segmentation, least-privilege access to network shares, and review of excessive write permissions.
  • Ensure endpoint security tooling is tamper-resistant and that tool health events are monitored by the SOC.
  • Prepare IR playbooks for rapid host isolation, credential containment, service restoration, and evidence preservation when encryption, service stop, or recovery inhibition is observed.
Additional notes and limits

ATT&CK identifies Avaddon as Windows ransomware and maps it to multiple techniques that are highly relevant to ransomware operations, including discovery, execution, persistence, privilege escalation, defense impairment, recovery inhibition, service stopping, and encryption for impact. The object does not provide official detection guidance, so the most defensible approach is to validate telemetry and detections against the related behaviors. External references include an in-depth Avaddon analysis and a threat-hunting article, but this take only uses the supplied ATT&CK fields and relationship context.

No official ATT&CK detection text, aliases, labels, or object-level tactics were supplied. Relationship descriptions are technique-level context and should not be interpreted as proof that every described platform or variant behavior applies to every Avaddon incident. Local validation is required to confirm telemetry availability, control effectiveness, false-positive rates, and recovery readiness.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Avaddon

Avaddon is ransomware written in C++ that has been offered as Ransomware-as-a-Service (RaaS) since at least June 2020.[1][2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

17 rows
DomainIDNameRelationship / procedure
EnterpriseT1614.001System Language DiscoverySub-technique

Avaddon checks for specific keyboard layouts and OS languages to avoid targeting Commonwealth of Independent States (CIS) entities.[2]

EnterpriseT1140Deobfuscate/Decode Files or Information

Avaddon has decrypted encrypted strings.[2]

EnterpriseT1489Service Stop

Avaddon looks for and attempts to stop database processes.[2]

EnterpriseT1059.007JavaScriptSub-technique

Avaddon has been executed through a malicious JScript downloader.[3][1]

EnterpriseT1083File and Directory Discovery

Avaddon has searched for specific files prior to encryption.[2]

EnterpriseT1685Disable or Modify Tools

Avaddon looks for and attempts to stop anti-malware solutions.[2]

EnterpriseT1106Native API

Avaddon has used the Windows Crypto API to generate an AES key.[3]

EnterpriseT1057Process Discovery

Avaddon has collected information about running processes.[2]

EnterpriseT1490Inhibit System Recovery

Avaddon deletes backups and shadow copies using native system tools.[3][2]

EnterpriseT1548.002Bypass User Account ControlSub-technique

Avaddon bypasses UAC using the CMSTPLUA COM interface.[2]

EnterpriseT1135Network Share Discovery

Avaddon has enumerated shared folders and mapped volumes.[2]

EnterpriseT1047Windows Management Instrumentation

Avaddon uses wmic.exe to delete shadow copies.[3]

EnterpriseT1486Data Encrypted for Impact

Avaddon encrypts the victim system using a combination of AES256 and RSA encryption schemes.[2]

EnterpriseT1112Modify Registry

Avaddon modifies several registry keys for persistence and UAC bypass.[2]

EnterpriseT1027Obfuscated Files or Information

Avaddon has used encrypted strings.[2]

EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

Avaddon uses registry run keys for persistence.[2]

EnterpriseT1016System Network Configuration Discovery

Avaddon can collect the external IP address of the victim.[1]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1614.001: System Language DiscoveryEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1489: Service StopEnterpriseuses · TechniqueT1059.007: JavaScriptEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1685: Disable or Modify ToolsEnterpriseuses · TechniqueT1106: Native APIEnterpriseuses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1490: Inhibit System RecoveryEnterpriseuses · TechniqueT1548.002: Bypass User Account ControlEnterpriseuses · TechniqueT1135: Network Share DiscoveryEnterpriseuses · TechniqueT1047: Windows Management InstrumentationEnterpriseuses · TechniqueT1486: Data Encrypted for ImpactEnterpriseuses · TechniqueT1112: Modify RegistryEnterpriseuses · TechniqueT1027: Obfuscated Files or InformationEnterpriseuses · TechniqueT1547.001: Registry Run Keys / Startup FolderEnterpriseuses · TechniqueT1016: System Network Configuration DiscoveryEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.0
Created
Modified
Raw hash
b22f1e0178893d0f...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.0Current bundleb22f1e017889…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Awake Security Avaddon

    Gahlot, A. (n.d.). Threat Hunting for Avaddon Ransomware. Retrieved August 19, 2021.

    Open source URL
  2. [2]
    Arxiv Avaddon Feb 2021

    Yuste, J. Pastrana, S. (2021, February 9). Avaddon ransomware: an in-depth analysis and decryption of infected systems. Retrieved August 19, 2021.

    Open source URL
  3. [3]
    Hornet Security Avaddon June 2020

    Security Lab. (2020, June 5). Avaddon: From seeking affiliates to in-the-wild in 2 days. Retrieved August 19, 2021.

    Open source URL
  4. [4]
    Arxiv Avaddon Feb 2021

    Yuste, J. Pastrana, S. (2021, February 9). Avaddon ransomware: an in-depth analysis and decryption of infected systems. Retrieved August 19, 2021.

    Open source URL
  5. [5]
    Arxiv Avaddon Feb 2021

    Yuste, J. Pastrana, S. (2021, February 9). Avaddon ransomware: an in-depth analysis and decryption of infected systems. Retrieved August 19, 2021.

    Open source URL
  6. [6]
    Awake Security Avaddon

    Gahlot, A. (n.d.). Threat Hunting for Avaddon Ransomware. Retrieved August 19, 2021.

    Open source URL
  7. [7]
    Awake Security Avaddon

    Gahlot, A. (n.d.). Threat Hunting for Avaddon Ransomware. Retrieved August 19, 2021.

    Open source URL
  8. [8]
    mitre-attackS0640
    Open source URL
  9. [9]
    mitre-attackS0640
    Open source URL
  10. [10]
    mitre-attackS0640
    Open source URL
  11. [11]
    Arxiv Avaddon Feb 2021

    Yuste, J. Pastrana, S. (2021, February 9). Avaddon ransomware: an in-depth analysis and decryption of infected systems. Retrieved August 19, 2021.

    Open source URL
  12. [12]
    Arxiv Avaddon Feb 2021

    Yuste, J. Pastrana, S. (2021, February 9). Avaddon ransomware: an in-depth analysis and decryption of infected systems. Retrieved August 19, 2021.

    Open source URL
  13. [13]
    Arxiv Avaddon Feb 2021

    Yuste, J. Pastrana, S. (2021, February 9). Avaddon ransomware: an in-depth analysis and decryption of infected systems. Retrieved August 19, 2021.

    Open source URL
  14. [14]
    Arxiv Avaddon Feb 2021

    Yuste, J. Pastrana, S. (2021, February 9). Avaddon ransomware: an in-depth analysis and decryption of infected systems. Retrieved August 19, 2021.

    Open source URL
  15. [15]
    Arxiv Avaddon Feb 2021

    Yuste, J. Pastrana, S. (2021, February 9). Avaddon ransomware: an in-depth analysis and decryption of infected systems. Retrieved August 19, 2021.

    Open source URL
  16. [16]
    Arxiv Avaddon Feb 2021

    Yuste, J. Pastrana, S. (2021, February 9). Avaddon ransomware: an in-depth analysis and decryption of infected systems. Retrieved August 19, 2021.

    Open source URL
  17. [17]
    Awake Security Avaddon

    Gahlot, A. (n.d.). Threat Hunting for Avaddon Ransomware. Retrieved August 19, 2021.

    Open source URL
  18. [18]
    Awake Security Avaddon

    Gahlot, A. (n.d.). Threat Hunting for Avaddon Ransomware. Retrieved August 19, 2021.

    Open source URL
  19. [19]
    Hornet Security Avaddon June 2020

    Security Lab. (2020, June 5). Avaddon: From seeking affiliates to in-the-wild in 2 days. Retrieved August 19, 2021.

    Open source URL
  20. [20]
    Arxiv Avaddon Feb 2021

    Yuste, J. Pastrana, S. (2021, February 9). Avaddon ransomware: an in-depth analysis and decryption of infected systems. Retrieved August 19, 2021.

    Open source URL
  21. [21]
    Arxiv Avaddon Feb 2021

    Yuste, J. Pastrana, S. (2021, February 9). Avaddon ransomware: an in-depth analysis and decryption of infected systems. Retrieved August 19, 2021.

    Open source URL
  22. [22]
    Arxiv Avaddon Feb 2021

    Yuste, J. Pastrana, S. (2021, February 9). Avaddon ransomware: an in-depth analysis and decryption of infected systems. Retrieved August 19, 2021.

    Open source URL
  23. [23]
    Arxiv Avaddon Feb 2021

    Yuste, J. Pastrana, S. (2021, February 9). Avaddon ransomware: an in-depth analysis and decryption of infected systems. Retrieved August 19, 2021.

    Open source URL
  24. [24]
    Hornet Security Avaddon June 2020

    Security Lab. (2020, June 5). Avaddon: From seeking affiliates to in-the-wild in 2 days. Retrieved August 19, 2021.

    Open source URL
  25. [25]
    Hornet Security Avaddon June 2020

    Security Lab. (2020, June 5). Avaddon: From seeking affiliates to in-the-wild in 2 days. Retrieved August 19, 2021.

    Open source URL
  26. [26]
    Arxiv Avaddon Feb 2021

    Yuste, J. Pastrana, S. (2021, February 9). Avaddon ransomware: an in-depth analysis and decryption of infected systems. Retrieved August 19, 2021.

    Open source URL
  27. [27]
    Arxiv Avaddon Feb 2021

    Yuste, J. Pastrana, S. (2021, February 9). Avaddon ransomware: an in-depth analysis and decryption of infected systems. Retrieved August 19, 2021.

    Open source URL
  28. [28]
    Arxiv Avaddon Feb 2021

    Yuste, J. Pastrana, S. (2021, February 9). Avaddon ransomware: an in-depth analysis and decryption of infected systems. Retrieved August 19, 2021.

    Open source URL
  29. [29]
    Arxiv Avaddon Feb 2021

    Yuste, J. Pastrana, S. (2021, February 9). Avaddon ransomware: an in-depth analysis and decryption of infected systems. Retrieved August 19, 2021.

    Open source URL
  30. [30]
    Hornet Security Avaddon June 2020

    Security Lab. (2020, June 5). Avaddon: From seeking affiliates to in-the-wild in 2 days. Retrieved August 19, 2021.

    Open source URL
  31. [31]
    Hornet Security Avaddon June 2020

    Security Lab. (2020, June 5). Avaddon: From seeking affiliates to in-the-wild in 2 days. Retrieved August 19, 2021.

    Open source URL
  32. [32]
    Arxiv Avaddon Feb 2021

    Yuste, J. Pastrana, S. (2021, February 9). Avaddon ransomware: an in-depth analysis and decryption of infected systems. Retrieved August 19, 2021.

    Open source URL
  33. [33]
    Arxiv Avaddon Feb 2021

    Yuste, J. Pastrana, S. (2021, February 9). Avaddon ransomware: an in-depth analysis and decryption of infected systems. Retrieved August 19, 2021.

    Open source URL
  34. [34]
    Arxiv Avaddon Feb 2021

    Yuste, J. Pastrana, S. (2021, February 9). Avaddon ransomware: an in-depth analysis and decryption of infected systems. Retrieved August 19, 2021.

    Open source URL
  35. [35]
    Arxiv Avaddon Feb 2021

    Yuste, J. Pastrana, S. (2021, February 9). Avaddon ransomware: an in-depth analysis and decryption of infected systems. Retrieved August 19, 2021.

    Open source URL
  36. [36]
    Hornet Security Avaddon June 2020

    Security Lab. (2020, June 5). Avaddon: From seeking affiliates to in-the-wild in 2 days. Retrieved August 19, 2021.

    Open source URL
  37. [37]
    Hornet Security Avaddon June 2020

    Security Lab. (2020, June 5). Avaddon: From seeking affiliates to in-the-wild in 2 days. Retrieved August 19, 2021.

    Open source URL
  38. [38]
    Arxiv Avaddon Feb 2021

    Yuste, J. Pastrana, S. (2021, February 9). Avaddon ransomware: an in-depth analysis and decryption of infected systems. Retrieved August 19, 2021.

    Open source URL
  39. [39]
    Arxiv Avaddon Feb 2021

    Yuste, J. Pastrana, S. (2021, February 9). Avaddon ransomware: an in-depth analysis and decryption of infected systems. Retrieved August 19, 2021.

    Open source URL
  40. [40]
    Arxiv Avaddon Feb 2021

    Yuste, J. Pastrana, S. (2021, February 9). Avaddon ransomware: an in-depth analysis and decryption of infected systems. Retrieved August 19, 2021.

    Open source URL
  41. [41]
    Arxiv Avaddon Feb 2021

    Yuste, J. Pastrana, S. (2021, February 9). Avaddon ransomware: an in-depth analysis and decryption of infected systems. Retrieved August 19, 2021.

    Open source URL
  42. [42]
    Arxiv Avaddon Feb 2021

    Yuste, J. Pastrana, S. (2021, February 9). Avaddon ransomware: an in-depth analysis and decryption of infected systems. Retrieved August 19, 2021.

    Open source URL
  43. [43]
    Arxiv Avaddon Feb 2021

    Yuste, J. Pastrana, S. (2021, February 9). Avaddon ransomware: an in-depth analysis and decryption of infected systems. Retrieved August 19, 2021.

    Open source URL
  44. [44]
    Arxiv Avaddon Feb 2021

    Yuste, J. Pastrana, S. (2021, February 9). Avaddon ransomware: an in-depth analysis and decryption of infected systems. Retrieved August 19, 2021.

    Open source URL
  45. [45]
    Arxiv Avaddon Feb 2021

    Yuste, J. Pastrana, S. (2021, February 9). Avaddon ransomware: an in-depth analysis and decryption of infected systems. Retrieved August 19, 2021.

    Open source URL
  46. [46]
    Awake Security Avaddon

    Gahlot, A. (n.d.). Threat Hunting for Avaddon Ransomware. Retrieved August 19, 2021.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use