H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Avaddon](https://attack.mitre.org/software/S0640) is ransomware written in C++ that has been offered as Ransomware-as-a-Service (RaaS) since at least June 2020.(Citation: Awake Security Avaddon)(Citation: Arxiv Avaddon Feb 2021)

Labels

malware

17 recorded

Relationships

uses

to Bypass User Account Control

Technique

uses

to Data Encrypted for Impact

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Disable or Modify Tools

Technique

uses

to File and Directory Discovery

Technique

uses

to Inhibit System Recovery

Technique

uses

to JavaScript

Technique

uses

to Modify Registry

Technique

uses

to Native API

Technique

uses

to Network Share Discovery

Technique

uses

to Obfuscated Files or Information

Technique

uses

to Process Discovery

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Service Stop

Technique

uses

to System Language Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to Windows Management Instrumentation

Technique

3 external

References

mitre-attack

S0640

open

Awake Security Avaddon

https://awakesecurity.com/blog/threat-hunting-for-avaddon-ransomware/

open

Arxiv Avaddon Feb 2021

https://arxiv.org/pdf/2102.04796.pdf

open