Avaddon

Avaddon was a ransomware group active from June 2020 to June 2021, operating on a ransomware-as-a-service model. It was known for a distinctive spam campaign distributing the ransomware via a "winking face" emoji lure and for conducting distributed denial-of-service (DDoS) attacks against victims as additional leverage alongside encryption and data exfiltration. Avaddon ran a public leak site called the "Avaddon Info" blog where it posted stolen data from non-paying victims. The group targeted organisations across the United States, Australia, Asia and Europe in sectors including manufacturing, healthcare and professional services.

In June 2021, Avaddon unexpectedly shut down, providing 2,934 decryption keys to Bleeping Computer and security firm Emsisoft, enabling victims to recover their data without paying. The motivation for the shutdown was not publicly explained; speculation ranged from law-enforcement pressure following the Colonial Pipeline attack (which had intensified US scrutiny of ransomware operations) to an operator decision to exit the market voluntarily. Emsisoft confirmed the keys were valid and released a free decryptor tool. Avaddon's infrastructure connections to First VPN were exposed in Europol's Operation Saffron on 21 May 2026, five years after the group ceased operations, indicating that First VPN's logs provided historical evidence of Avaddon's operational-security infrastructure even post-shutdown.

Avaddon's appearance in the Operation Saffron context illustrates how criminal VPN services create historical forensic trails: even groups that voluntarily dissolved leave infrastructure footprints in logs that law enforcement can exploit years later. The disclosure also raises the possibility that First VPN's logs may reveal historical attribution data for other ransomware campaigns linked to groups using the service.