A Ransom Group Stops Campaign And Delivered Keys To Victims

Ransomware backers must be unscrupulous, but what goes on around the Avaddon malware is undoubtedly good news for the victims. Avaddon has stopped blackmailing and is supplying victims with everything they need to decrypt.

Ransomware stops working and releases all victims

The activity related to ransomware, i.e. software that is mostly used to blackmail its victims by encrypting data for ransom payments, has increased sharply in the last few months – most recently a real wave had rolled over the USA. So it’s all the more gratifying when you can report good news about digital blackmail. “The Avaddon ransomware gang has ceased operations and passed on the decryption keys for their victims to BleepingComputer.com,” said the experts from BleepingComputer in a recent release.

Read More: Foxconn Refused To Pay $34.5 Million In A Recent Ransomware Attack

The way the end of ransomware came to be known sounds like a real crime story. BleepingComputer received an anonymous message on June 11th claiming to be connected to the FBI. The message also contains a password and a link to a protected ZIP file. The alleged content of the file: Decryption keys for the Avaddon ransomware. In cooperation with experts from Emsisoft and Coveware, it was then possible to confirm: The keys are actually real.

In the next step, Emsisoft developed a first test decryptor. BleepingComputer then tested this software to decrypt a virtual machine that had been encrypted with a recent sample from Avaddon. “The threat actors sent us a total of 2,934 decryption keys, each key corresponding to a specific victim,” the experts said. The suitable free decryptor comes from Emsisoft.

Law Enforcement Pressure

But you can’t expect a sudden change of heart or really good intentions on the part of the people behind you. Since it started in 2020, Avaddon had achieved a top position among the ransomware used worldwide. This success, of course, has resulted in law enforcement officers like the FBI stepping up their investigations. “Recent law enforcement actions have made some threat actors nervous: this is the result. One is done and we hope some others go under,” Emsisoft threat analyst Brett Callow told BleepingComputer.