Home > List all groups > Avalanche

Threat Group Cards: A Threat Actor Encyclopedia

Permanent link Other threat group: Avalanche

NamesAvalanche (?)
CountryRussia Russia
MotivationFinancial gain
First seen2006
Description(US-CERT) Cyber criminals utilized Avalanche botnet infrastructure to host and distribute a variety of malware variants to victims, including the targeting of over 40 major financial institutions. Victims may have had their sensitive personal information stolen (e.g., user account credentials). Victims’ compromised systems may also have been used to conduct other malicious activity, such as launching denial-of-service (DoS) attacks or distributing malware variants to other victims’ computers.

In addition, Avalanche infrastructure was used to run money mule schemes where criminals recruited people to commit fraud involving transporting and laundering stolen money or merchandise.

Avalanche used fast-flux DNS, a technique to hide the criminal servers, behind a constantly changing network of compromised systems acting as proxies.

Avalanche has been observed to distribute GozNym (operated by Bamboo Spider, TA544|used-by}} and much of the malware from TA505, Graceful Spider, Gold Evergreen.
ObservedCountries: Worldwide.
Tools usedAvalanche.
Operations performedMay 2010Worst Phishing Pest May be Revving Up
Counter operationsDec 2016‘Avalanche’ network dismantled in international cyber operation

Last change to this card: 14 May 2020

Download this actor card in PDF or JSON format

Thailand Computer Emergency Response Team (ThaiCERT)
Electronic Transactions Development Agency

Follow us on

Facebook Twitter

Report incidents

Telephone +66 (0)2-123-1234
PGP Download PGP key