Skip to main content

SynAck ransomware group releases decryption keys, but new strain in the works

Lock on Laptop Screen
(Image credit: Future)
Audio player loading…

The SynAck ransomware group, which recently changed its name to El_Cometa, has released the master decryption keys to its ransomware (opens in new tab) that was used to infect victims from 2017 to early 2021.

In a new exclusive report (opens in new tab) from The Record, the news outlet has reported that the keys have now been verified as authentic by creator of the ID Ransomware service and malware analyst at Emsisoft, Micheal Gillespie. Gillespie confirmed the authenticity of the master decryption keys by using them to decrypt files from previous SynAct attacks.

Unfortunately for SynAct victims, decrypting the cybercriminals' ransomware is somewhat complicated for non-technical users. Thankfully though, Emsisoft plans on releasing its own decryption utility in the next few days which will not only be easier to user but will also be safer.

El_Cometa ransomware

The SynAck ransomware group was first identified back in July of 2017 though the group quickly rose to prominence due to its encryption routines and the way in which it used process doppelganging to evade being detected by antivirus software (opens in new tab).

Although the group continued to operate during the following years, it was soon overshadowed by larger ransomware groups including, REvil (opens in new tab), Ryuk (opens in new tab) and BitPaymer (opens in new tab).

The reason the group decided to release the master decryption keys for its old victims is because it is in the process of winding down its SynAck operation as it ramps up work on its new ransomware strain, El_Cometa.

While the group has worked with outside partners in the past to distribute its ransomware, it now plans to expand its operational model by launching a new Ransomware-as-a-Service (RaaS (opens in new tab)) platform and recruiting new partners or affiliates to carry out its attacks.

Expect the El_Cometa ransomware strain to infect additional victims as the cybercriminals behind it expand their operations.

Via The Record (opens in new tab)

After working with the TechRadar Pro team for the last several years, Anthony is now the security and networking editor at Tom’s Guide where he covers everything from data breaches and ransomware gangs to the best way to cover your whole home or business with Wi-Fi. When not writing, you can find him tinkering with PCs and game consoles, managing cables and upgrading his smart home.