UPDATED 20:56 EDT / FEBRUARY 07 2021

SECURITY

Ziggy ransomware group shuts down amid concern over law enforcement actions

The Ziggy ransomware group has shut down and released a decryption key amid concern that it may be targeted by law enforcement, according to a report today from Bleeping Computer.

The group reportedly announced on a Telegram group that it would be shutting down, with a message that included the phrase “we are very sad about what we did.” The ransomware administrator told Bleeping Computer that the group had created the ransomware to generate money since the members live in a developing country, and they were concerned over recent law enforcement actions against Emotet and Netwalker ransomware.

Emotet, which was an infamous botnet that emerged in 2014, reemerged in July after a five-month break, prompting a warning from the U.S. Department of Homeland Security’s Cybersecurity and Infrastructure Agency in October. A joint international strike force coordinated by the European Union Agency for Law Enforcement Cooperation seized servers and made arrests in relation to Emotet Jan. 27. On the same date, a joint operation between U.S. and Bulgarian authorities led to the arrest and seizure of servers relating to the Netwalker ransomware.

Ziggy ransomware was a standard form of ransomware that infects targeted computers, initiated the encryption of files, then demanded a ransom for a decryption key. It could even be described as old-fashioned ransomware: Unlike many newer forms of ransomware over the last 12 months, Ziggy did not steal files, simply encrypting files and demanding payment.

Those behind Ziggy have apparently now released the decryption key, but as security researcher M. Shahpasandi noted on Twitter, the decryption release included malicious files.

Those behind the Ziggy ransomware are seemingly not alone in their concern about potentially getting caught following the raids on Emotet and Netwalker: Fonix ransomware announced last week that it’s also shutting down operations.

Officially, the operators of Fonix said that they had come to the conclusion that they “should use our abilities in positive ways to help others.” The code for the Fonix ransomware has been deleted and a master RSA key published that can be used to decrypt files.

Image: Pixabay

A message from John Furrier, co-founder of SiliconANGLE:

Your vote of support is important to us and it helps us keep the content FREE.

One click below supports our mission to provide free, deep, and relevant content.  

Join our community on YouTube

Join the community that includes more than 15,000 #CubeAlumni experts, including Amazon.com CEO Andy Jassy, Dell Technologies founder and CEO Michael Dell, Intel CEO Pat Gelsinger, and many more luminaries and experts.

“TheCUBE is an important partner to the industry. You guys really are a part of our events and we really appreciate you coming and I know people appreciate the content you create as well” – Andy Jassy

THANK YOU