The US Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) recently released a joint cybersecurity advisory regarding the continued emergence of ransomware-as-a-service (RaaS) operations. The report also detailed the AvosLocker ransomware gang’s linkage to attacks targeting the critical infrastructure sectors in the US. The AvosLocker group uses their own ransomware variant that is believed to have emerged in mid-2021 and affects Windows, Linux, and VMware ESXi environments with capabilities such as disabling antivirus protections and evading other detection measures. AvosLocker affiliated attacks are notorious for their living-off-the-land (LotL) tactics, which decreases traces left behind and increases the difficulty of attributing attacks. Another common technique seen being used to compromise organizations’ networks is the use of legitimate software, utilities, and tools (i.e., FileZilla, Rclone, Chisel, and Ligolo) for data exfiltration and tunneling activities. Further aspects of AvosLocker attacks include the use of Cobalt Strike and Silver for command-and-control (C2), Mimikatz and Lazagne for credential theft, and custom PowerShell and Windows Batch scripts for lateral movement, privilege escalation, and disarming security software. A new component observed in recent AvosLocker affiliated attacks is an executable that masquerades as a network monitoring tool but is actually used by the threat actor as a reverse proxy to connect to the host from outside the victim’s network. Agencies like CISA and the FBI have released heightened concerns about RaaS operations, like those conducted by AvosLocker and others, because of the influx over the last year where novice cybercriminals have a lowered the barrier of entry into illicit activities with the ability to use sophisticated tools and tactics against high profile targets.