Connect with us

Hi, what are you looking for?

HEADLINES

AvosLocker ransomware uses AnyDesk in safe mode to launch attacks

Sophos explains how attackers attempt to bypass security controls by using a combination of Windows Safe Mode and the AnyDesk remote administration tool. Windows Safe Mode is an IT support method for resolving IT issues that disable most security and IT administration tools, while AnyDesk provides continuous remote access. 

Sophos, a leader in next-generation cybersecurity, recently released new research about AvosLocker ransomware in the article,“AvosLocker Remotely Accesses Boxes, Even Running in Safe Mode.” Sophos explains how attackers attempt to bypass security controls by using a combination of Windows Safe Mode and the AnyDesk remote administration tool. Windows Safe Mode is an IT support method for resolving IT issues that disable most security and IT administration tools, while AnyDesk provides continuous remote access. 

AvosLocker is a relatively new ransomware-as-a service that first appeared in late June 2021 and is growing in popularity, according to Sophos. The Sophos Rapid Response team has so far seen AvosLocker attacks in the Americas, Middle East and Asia-Pacific, targeting Windows and Linux systems.

“Sophos discovered that the AvosLocker attackers installed AnyDesk so it works in Safe Mode, tried to disable the components of security solutions that run in Safe Mode, and then ran the ransomware in Safe Mode. This creates a scenario where the attackers have full remote control over every machine they’ve set up with AnyDesk, while the target organization is likely locked out of remote access to those computers. Sophos has never seen some of these components used with ransomware, and certainly not together,” said Peter Mackenzie, director of incident response at Sophos. “The message for IT security teams facing such an attack is that even if the ransomware fails to run, until they clean every trace of the attackers’ AnyDesk deployment from every impacted machine, they will remain exposed as the attackers have access to their organization’s network and can lock them out again at any time.”

The Ransomware Deployment Process

Sophos researchers investigating the ransomware deployment found that the main sequence starts with attackers using PDQ Deploy to run and execute a batch script called “love.bat,” “update.bat,” or “lock.bat” on targeted machines. The script issues and implements a series of consecutive commands that prepare the machines for the release of the ransomware and then reboots into Safe Mode.

Advertisement. Scroll to continue reading.

The command sequence takes approximately five seconds to execute and includes the following:

  • Disabling Windows update services and Windows Defender
  • Attempting to disable the components of commercial security software solutions that can run in Safe Mode
  • Installing the legitimate remote administration tool AnyDesk and setting it to run in Safe Mode while connected to the network, ensuring continued command and control by the attacker
  • Setting up a new account with auto login details and then connecting to the target’s domain controller to remotely access and run the ransomware executable, called update.exe

“The techniques used by AvosLocker are simple, but very clever. They ensure that the ransomware has the best chance of running in Safe Mode and allow the attackers to retain remote access to the machines throughout the attack,” said Mackenzie. “Sophos has reported on Snatch and BlackMatter implementing the technique, however, neither of these ransomware groups attempted to install a subsequent application, such as AnyDesk, for command and control of the machines while in Safe Mode. We believe we’re seeing this for the first time.”

Sophos endpoint products, such as Intercept X, protect users by detecting the actions and behaviors of ransomware and other attacks, such as those described in this Sophos research.  

Advertisement
Advertisement
Advertisement

Like Us On Facebook

You May Also Like

HEADLINES

In the 2025 Voice of the Customer for Endpoint Protection Platforms, Sophos received a 4.8/5.0 rating based on 361 reviews as of 31 Jan 2025....

HEADLINES

The NTSC is an industry-wide alliance of corporate security professionals representing the country’s major telecommunications companies, including PLDT Inc., Smart Communications, Inc., Globe Telecom,...

HEADLINES

Globally, almost one in four report losses exceeding $5,000,000, and for some, it surpasses $10,000,000. These findings were revealed in a joint study conducted...

HEADLINES

In a new report covering Q2 2024 – Q1 2025, Kaspersky has found over 250,000 cyberattacks disguised as popular anime among other shows and streaming platforms...

HEADLINES

From January to December 2024, Kaspersky solutions used by businesses here detected and blocked more than 53 million bruteforce attacks. 

HEADLINES

According to Kaspersky experts, 2024 saw over 3 billion malware attacks globally, with a daily average of 467,000 malicious files detected. Windows systems were...

HEADLINES

Cybercriminals target SMBs, schools, and other smaller organizations because they often have less robust security compared to large corporations and other institutions. 

HEADLINES

Sophos Counter Threat Unit revealed the NICKEL TAPESTRY threat group’s scheme involving fraudulent workers operating on behalf of North Korea (formally known as the...

Advertisement