Avaddon
Software · ATTACK:enterprise:S0640
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0640",
"title": "Avaddon",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0640",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--58c5a3a1-928f-4094-9e98-a5a4e56dd5f3",
"external_id": "S0640",
"domain": "enterprise",
"created": "2021-08-23T19:38:33.073Z",
"modified": "2025-04-25T14:43:26.180Z",
"version": "1.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Awake Security Avaddon",
"url": "https://awakesecurity.com/blog/threat-hunting-for-avaddon-ransomware/"
},
{
"source_name": "Arxiv Avaddon Feb 2021",
"url": "https://arxiv.org/pdf/2102.04796.pdf"
}
]
}Explicit source assertions (17)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0640 → uses → ATTACK:enterprise:T1614.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1d47e8c0-9f0d-41d1-a889-609025b42298
Arxiv Avaddon Feb 2021ATTACK:enterprise:S0640 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1f67c603-a567-42d1-b1ee-48fe9564c9bc
Arxiv Avaddon Feb 2021ATTACK:enterprise:S0640 → uses → ATTACK:enterprise:T1489
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--238f92b3-2573-4332-b290-4685301eae6d
Arxiv Avaddon Feb 2021ATTACK:enterprise:S0640 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4142d0fd-6c96-417f-8725-17eabf444854
Hornet Security Avaddon June 2020 · Awake Security AvaddonATTACK:enterprise:S0640 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--431043b7-f0e8-411b-8eec-0d602867b028
Arxiv Avaddon Feb 2021ATTACK:enterprise:S0640 → uses → ATTACK:enterprise:T1685
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--50a17d24-155e-4036-8a58-a8c376f36c05
Arxiv Avaddon Feb 2021ATTACK:enterprise:S0640 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--53948a0d-1c53-4569-b6b3-78b7738793c3
Hornet Security Avaddon June 2020ATTACK:enterprise:S0640 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5b37bd8c-d5a6-4564-a110-bb515ff9f78c
Arxiv Avaddon Feb 2021ATTACK:enterprise:S0640 → uses → ATTACK:enterprise:T1490
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5b8d22c5-f191-4dc3-a4ee-04c7d8b799da
Hornet Security Avaddon June 2020 · Arxiv Avaddon Feb 2021ATTACK:enterprise:S0640 → uses → ATTACK:enterprise:T1548.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6efcb476-efdb-414c-80f8-66fe84f7c7e3
Arxiv Avaddon Feb 2021ATTACK:enterprise:S0640 → uses → ATTACK:enterprise:T1135
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a7be99ec-2a20-406a-b552-7c32760bb52c
Arxiv Avaddon Feb 2021ATTACK:enterprise:S0640 → uses → ATTACK:enterprise:T1047
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b26c15f9-0679-402b-bcf5-bdae40921f93
Hornet Security Avaddon June 2020ATTACK:enterprise:S0640 → uses → ATTACK:enterprise:T1486
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b844f979-ddd2-4def-8d07-89b56ef10713
Arxiv Avaddon Feb 2021ATTACK:enterprise:S0640 → uses → ATTACK:enterprise:T1112
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c27ceec5-2eaf-4b3b-8120-9fb691d6458b
Arxiv Avaddon Feb 2021ATTACK:enterprise:S0640 → uses → ATTACK:enterprise:T1027
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cc134d2d-64eb-469a-b8eb-90ea632c0adc
Arxiv Avaddon Feb 2021ATTACK:enterprise:S0640 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cfda1087-90e8-46f3-9751-06e2140f2f2c
Arxiv Avaddon Feb 2021ATTACK:enterprise:S0640 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--deca3e0f-7c9a-44f2-aff5-db94ce5933e1
Awake Security Avaddon