extortion.wiki THE RANSOMWARE DOCUMENTARY ARCHIVE
Menu

242 negotiations · 332 notes · 276 seizure banners · snapshots Jul 06, 2026 / Jun 26, 2026 / Jul 23, 2026

Avos

From extortion.wiki, the ransomware negotiation research archive

Negotiation records classified under Avos in the current Ransomchats snapshot. This page indexes the source label; it does not independently verify attribution.

Classification follows the source dataset. Metadata is useful. It is not testimony.

Actor lineage

Global lineage directory

Overview

AvosLocker is documented as a RaaS variant with affiliates. The archive preserves the original Ransomchats label “Avos” separately from this normalized display name.

Source name
Avos
Canonical lineage name
AvosLocker
Entity model
operation
First observed
June 2021
Last observed
Date not established
Current status
Not established

Documentary media

First page of the official StopRansomware AvosLocker advisory
Joint AvosLocker ransomware advisoryFirst-page preview of the FBI and CISA joint AvosLocker advisory describing the ransomware-as-a-service operation and affiliate activity.FBI and CISA · published 2023-10-11 · Contextual materialEvidence status:officially confirmed · Rights/review:documentary excerpt reviewedA low-resolution first-page excerpt is used to identify and discuss the underlying official advisory. Agency marks remain only within the unaltered document preview; no general reuse license is claimed.Source: FBI and CISA joint advisory AA23-284A.

Known aliases

Evidence-backed names associated with this lineage record
AliasTypeFirst observedLast observedConfidenceSources
AvosAvos is the source label in Ransomchats. The canonical AvosLocker display is an explicit archive normalization backed by the corresponding government advisory; it does not confirm the identity of every user of the malware. Operation name Date not established Date not established Moderate confidence Casualtek · FBI and CISA

Historical timeline

Lineage and relationships

No evidence-backed relationship is currently recorded. Similar code, language, infrastructure style, or negotiation behavior is not enough on its own.

Predecessors

None established.

Successors

None established.

Splits and mergers

None established.

Suspected affiliate relationships

None established.

MITRE ATT&CK integration

No explicit MITRE ATT&CK group mapping is published for this source label. Software entries and fuzzy name matches are not promoted to group mappings.

External intelligence references

  1. Casualtek/RansomchatsCasualtek · dataset provenance · context only
  2. #StopRansomware: AvosLocker Ransomware (Update)FBI and CISA · government advisory · primary authoritative
  3. AvosLocker, Software S1053MITRE ATT&CK · MITRE ATTACK · authoritative secondary

Confidence and evidence notes

Confidence applies to each individual alias, event, or relationship—not to the actor page as a whole. “Confirmed” requires explicit authoritative attribution or multiple strong independent sources. Moderate, low, disputed, and unknown entries retain the source's uncertainty. A malware-family name is not automatically an actor identity, and shared code or affiliates do not prove shared leadership.

Ransomware notes

Browse Avoslocker notes

The explicit archive alias mapping connects this Ransomchats actor label to the ThreatLabz family Avoslocker. Its 1 archived note is counted and searched separately from the negotiation records below.

Search within this collection

Negotiation records

Filter Avos records

Collection: 1 records · 86 messages

Avos negotiation record collection
Participants Source Archive status
20210903 86 Avos, Victim JSON Indexed