Ransomware group profile · #84 by claimed victims

Avoslocker ransomware

AvosLocker is the ransomware payload of the Avos RaaS group, active from July 2021 to approximately May 2023, targeting education, manufacturing, and healthcare sectors on Windows, Linux, and VMware ESXi environments, with the US accounting for ~72% of victims.

Active First seen Jun 2021

70Victims claimed on leak sites

0Victims in the last 30 days

0Victims in the last 90 days

9Countries hit

2Leak-site URLs tracked, 0 online

11 Feb 2023Latest claim recorded

Victimology

Who Avoslocker claims to have breached, from 70 leak-site posts recorded by VULONE.

Claims per month last 12 months

Top sectors

Manufacturing15

Education9

Professional Services8

Healthcare7

Technology7

Transportation6

Financial Services5

Retail & E-Commerce3

Top countries

United States4

Indonesia1

Botswana1

Guatemala1

Canada1

Paraguay1

China1

Singapore1

Latest claimed victims 12 most recent

Victim	Sector	Country	Claimed
Cambian Group caretech-uk.com	Healthcare	—	11 Feb 2023
Memtech Acoustical memtechacoustical.com	Manufacturing	—	11 Feb 2023
Global Mining Products	Energy & Utilities	ID	11 Feb 2023
Buckeye Packaging	Manufacturing	—	11 Feb 2023
Wesco Turf wescoturf.com	Agriculture and Food Production	US	11 Feb 2023
CannonDesign cannondesign.com	Professional Services	—	11 Feb 2023
Schandy	Professional Services	—	11 Feb 2023
Ultralife Corporation ultralifecorp.com	Manufacturing	US	11 Feb 2023
Hamilton Parker hamiltonparker.com	Professional Services	—	11 Feb 2023
Corporate Interiors Inc	Professional Services	—	7 Jan 2023
LW Group	Retail & E-Commerce	—	26 Dec 2022
Keyano College	Education	CA	26 Dec 2022

All 70 Avoslocker victims, searchable

Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.

Start free Sign in

Tactics, techniques and procedures

ATT&CK technique mapping for Avoslocker is in progress. Victimology, infrastructure status and leak-site tracking are live above.

Indicators, detections and the full playbook

Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.

See full IOCs

Frequently asked

Is Avoslocker ransomware still active?

Avoslocker is tracked as active. The most recent leak-site claim VULONE recorded is dated 11 February 2023.

How many victims has Avoslocker claimed?

VULONE has recorded 70 leak-site victim claims attributed to Avoslocker since June 2021, across 9 countries and 14 sectors.

Which industries does Avoslocker target?

The sectors most often named on the Avoslocker leak site are Manufacturing, Education, Professional Services.

Which countries are most affected by Avoslocker?

Most Avoslocker victims recorded by VULONE are located in United States, Indonesia, Botswana.

Where does VULONE get Avoslocker victim data?

Claims are collected continuously from the group's own leak sites and cross-checked with ransomware.live and RansomLook. A claim is the group's assertion, not a confirmed breach.

Other ransomware groups

Victim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 16 September 2026. Questions or corrections: [email protected].