{
	"id": "d384a587-8b0e-429d-a3e0-bcc1a9985e8e",
	"created_at": "2026-04-06T00:12:56.341423Z",
	"updated_at": "2026-04-10T13:12:48.500913Z",
	"deleted_at": null,
	"sha1_hash": "1881e63b0c7f52634dcd96a368548fd2b2a96796",
	"title": "Avalanche (crimeware-as-a-service infrastructure) | CISA",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 59362,
	"plain_text": "Avalanche (crimeware-as-a-service infrastructure) | CISA\r\nPublished: 2016-12-14 · Archived: 2026-04-02 12:31:43 UTC\r\nSystems Affected\r\nMicrosoft Windows\r\nOverview\r\n“Avalanche” refers to a large global network hosting infrastructure used by cyber criminals to conduct phishing\r\nand malware distribution campaigns and money mule schemes. The United States Department of Homeland\r\nSecurity (DHS), in collaboration with the Federal Bureau of Investigation (FBI), is releasing this Technical Alert\r\nto provide further information about Avalanche.\r\nCyber criminals utilized Avalanche botnet infrastructure to host and distribute a variety of malware variants to\r\nvictims, including the targeting of over 40 major financial institutions. Victims may have had their sensitive\r\npersonal information stolen (e.g., user account credentials). Victims’ compromised systems may also have been\r\nused to conduct other malicious activity, such as launching denial-of-service (DoS) attacks or distributing malware\r\nvariants to other victims’ computers.\r\nIn addition, Avalanche infrastructure was used to run money mule schemes where criminals recruited people to\r\ncommit fraud involving transporting and laundering stolen money or merchandise.\r\nAvalanche used fast-flux DNS, a technique to hide the criminal servers, behind a constantly changing network of\r\ncompromised systems acting as proxies.\r\nThe following malware families were hosted on the infrastructure:\r\nWindows-encryption Trojan horse (WVT) (aka Matsnu, Injector,Rannoh,Ransomlock.P)\r\nURLzone (aka Bebloh)\r\nCitadel\r\nVM-ZeuS (aka KINS)\r\nBugat (aka Feodo, Geodo, Cridex, Dridex, Emotet)\r\nnewGOZ (aka GameOverZeuS)\r\nTinba (aka TinyBanker)\r\nNymaim/GozNym\r\nVawtrak (aka Neverquest)\r\nMarcher\r\nPandabanker\r\nRanbyus\r\nSmart App\r\nTeslaCrypt\r\nhttps://www.us-cert.gov/ncas/alerts/TA16-336A\r\nPage 1 of 3\n\niBanking Trusteer App Trojan\r\nXswkit\r\nAvalanche was also used as a fast flux botnet which provides communication infrastructure for other botnets,\r\nincluding the following:        \r\nTeslaCrypt\r\nNymaim\r\nCorebot\r\nGetTiny\r\nMatsnu\r\nRovnix\r\nUrlzone\r\nQakBot (aka Qbot, PinkSlip Bot)\r\nImpact\r\nA system infected with Avalanche-associated malware may be subject to malicious activity including the theft of\r\nuser credentials and other sensitive data, such as banking and credit card information. Some of the malware had\r\nthe capability to encrypt user files and demand a ransom be paid by the victim to regain access to those files. In\r\naddition, the malware may have allowed criminals unauthorized remote access to the infected computer. Infected\r\nsystems could have been used to conduct distributed denial-of-service (DDoS) attacks.\r\nSolution\r\nUsers are advised to take the following actions to remediate malware infections associated with Avalanche:\r\nUse and maintain anti-virus software – Anti-virus software recognizes and protects your computer against\r\nmost known viruses. Even though parts of Avalanche are designed to evade detection, security companies\r\nare continuously updating their software to counter these advanced threats. Therefore, it is important to\r\nkeep your anti-virus software up-to-date. If you suspect you may be a victim of an Avalanche malware,\r\nupdate your anti-virus software definitions and run a full-system scan. (See Understanding Anti-Virus\r\nSoftware for more information.)\r\nAvoid clicking links in email – Attackers have become very skilled at making phishing emails look\r\nlegitimate. Users should ensure the link is legitimate by typing the link into a new browser (see Avoiding\r\nSocial Engineering and Phishing Attacks for more information).\r\nChange your passwords – Your original passwords may have been compromised during the infection, so\r\nyou should change them. (See Choosing and Protecting Passwords for more information.)\r\nKeep your operating system and application software up-to-date – Install software patches so that attackers\r\ncannot take advantage of known problems or vulnerabilities. You should enable automatic updates of the\r\noperating system if this option is available. (See Understanding Patches for more information.)\r\nUse anti-malware tools – Using a legitimate program that identifies and removes malware can help\r\neliminate an infection. Users can consider employing a remediation tool. A non-exhaustive list of examples\r\nis provided below. The U.S. Government does not endorse or support any particular product or vendor.\r\nhttps://www.us-cert.gov/ncas/alerts/TA16-336A\r\nPage 2 of 3\n\nESET Online Scanner\r\n          https://www.eset.com/us/online-scanner/   \r\n          F-Secure\r\n          https://www.f-secure.com/en/web/home_global/online-scanner\r\n          McAfee Stinger\r\n          http://www.mcafee.com/us/downloads/free-tools/index.aspx\r\n          Microsoft Safety Scanner\r\n          https://www.microsoft.com/security/scanner/en-us/default.aspx\r\n          Norton Power Eraser\r\n          https://norton.com/npe\r\n         Trend Micro HouseCall\r\n          http://housecall.trendmicro.com/\r\nReferences\r\nhttp://www.bankinfosecurity.com/avalanche-group-linked-to-fraud-a-2573\r\nRevisions\r\nDecember 1, 2016: Initial release|December 2, 2016: Added TrendMicro Scanner\r\nSource: https://www.us-cert.gov/ncas/alerts/TA16-336A\r\nhttps://www.us-cert.gov/ncas/alerts/TA16-336A\r\nPage 3 of 3",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"Malpedia",
		"ETDA"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://www.us-cert.gov/ncas/alerts/TA16-336A"
	],
	"report_names": [
		"TA16-336A"
	],
	"threat_actors": [
		{
			"id": "b753c6a8-a83d-47bc-829d-45e56136eb7d",
			"created_at": "2023-01-06T13:46:38.97802Z",
			"updated_at": "2026-04-10T02:00:03.169611Z",
			"deleted_at": null,
			"main_name": "GozNym",
			"aliases": [],
			"source_name": "MISPGALAXY:GozNym",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "bc289ba8-bc61-474c-8462-a3f7179d97bb",
			"created_at": "2022-10-25T16:07:24.450609Z",
			"updated_at": "2026-04-10T02:00:04.996582Z",
			"deleted_at": null,
			"main_name": "Avalanche",
			"aliases": [],
			"source_name": "ETDA:Avalanche",
			"tools": [],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434376,
	"ts_updated_at": 1775826768,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/1881e63b0c7f52634dcd96a368548fd2b2a96796.pdf",
		"text": "https://archive.orkl.eu/1881e63b0c7f52634dcd96a368548fd2b2a96796.txt",
		"img": "https://archive.orkl.eu/1881e63b0c7f52634dcd96a368548fd2b2a96796.jpg"
	}
}