The Cybersecurity & Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) released a Joint Cybersecurity Advisory on October 11, 2023, urging companies (particularly those in the critical infrastructure sector) to take steps to mitigate cyber threats for AvosLocker Ransomware.
The Advisory urges companies to:
- Secure remote access tools
- Restrict Remote Desktop Protocol (RDP) and other remote desktop services
- Secure PowerShell and/or restrict usage
- Update software to the latest version and apply patching updates regularly
AvosLocker “operates under a ransomware-as-a-service model and has attacked critical infrastructure companies in the US “by using legitimate software and open-source remote system administration tools. AvosLocker affiliates then use exfiltration-based data extortion tactics with threats of leaking and/or publishing stolen data.”
The indicators of compromise and mitigation steps are outlined in the Advisory.