Privacy Ninja

AvosLocker Ransomware Reboots in Safe Mode to Bypass Security Tools

AvosLocker Ransomware Reboots in Safe Mode to Bypass Security Tools

In recent attacks, the AvosLocker ransomware gang has started focusing on disabling endpoint security solutions that stand in their way by rebooting compromised systems into Windows Safe Mode.

This tactic makes it easier to encrypt victims’ files since most security solutions will be automatically disabled after Windows devices boot in Safe Mode.

And their new approach appears to be quite effective since the number of attacks attributed to the particular group is rising.

Also Read: 5 Types of Ransomware, Distinguished

Encrypting in ‘Safe Mode’

AvosLocker operators leverage PDQ Deploy, a legitimate deployment tool for automating patch management, to drop several Windows batch scripts onto the target machine, which helps them to lay the ground for the attack, according to a report from SophosLabs Principal Researcher Andrew Brandt.

These scripts modify or delete Registry keys that belong to specific endpoint security tools, including Windows Defender and products from Kaspersky, Carbon Black, Trend Micro, Symantec, Bitdefender, and Cylance.

One of the batch script files used by Avos Locker
One of the batch script files used by AvosLocker (Sophos)

The scripts also create a new user account on the compromised machine, naming it ‘newadmin’ and adding it to the Administrators user group.

Next, they configure that account to automatically log in when the system reboots into Safe Mode with Networking and disable “legal notice” dialog registry keys that could hamper the automatic login.

Finally, the scripts execute a reboot command which puts the machine into Safe Mode. Once it’s up again, the ransomware payload is run from a Domain Controller location.

Also Read: Data Protection Policy: 8 GDPR Compliance Tips

If the automated payload execution process fails, the actor can assume manual control of the procedure using the AnyDesk remote access tool.

“The penultimate step in the infection process is the creation of a ‘RunOnce’ key in the Registry that executes the ransomware payload, filelessly, from where the attackers have placed it on the Domain Controller,” explains Brandt.

“This is a similar behavior to what we’ve seen IcedID and other ransomware do as a method of executing malware payloads without letting the files ever touch the filesystem of the infected computer.”

Entire operation of the dropped batch scripts
Batch scripts being dropped (Sophos)

Safe Mode used to easily bypass endpoint security

This same Safe Mode execution method was previously used by other ransomware groups, including REvil (with auto-login too), BlackMatter, and Snatch, so this is clearly a security gap that needs to be addressed.

The whole idea behind putting the machine in Safe Mode is to disable any running security tools since most endpoint protection solutions don’t run in that mode.

Thanks to this simple yet effective trick, even adequately protected machines can be rendered defenseless against ransomware execution chains.

To avoid arbitrary reboot commands from manifesting on your machines, ensure that your security tools can detect and prevent the addition of suspicious Registry keys.

This capability could interfere with legitimate Registry access, but it is well worth the additional trouble for admins.

As Sophos underlines in its report, no alert should be treated as “low priority,” as a small and seemingly innocuous thing could be a pivotal link to a ransomware execution chain.

Outsourced Data Protection Officer – It is mandatory to appoint a Data Protection Officer. We help our clients quickly comply with their PDPA & data protection requirements.

Vulnerability Assessment Penetration Testing – Find loopholes in your websites, mobile apps or systems.

Smart Contract Audit – Leverage our industry-leading suite of blockchain security analysis tools, combined with hands-on review from our veteran smart contract auditors.



Subscribe to our mailing list to get free tips on Data Protection and Data Privacy updates weekly!

Personal Data Protection


We have assisted numerous companies to prepare proper and accurate reports to PDPC to minimise financial penalties.

Powered by WhatsApp Chat

× Chat with us