The SynAck ransomware group, which recently changed its name to El_Cometa, has released the master decryption keys to its ransomware (opens in new tab) that was used to infect victims from 2017 to early 2021.
In a new exclusive report (opens in new tab) from The Record, the news outlet has reported that the keys have now been verified as authentic by creator of the ID Ransomware service and malware analyst at Emsisoft, Micheal Gillespie. Gillespie confirmed the authenticity of the master decryption keys by using them to decrypt files from previous SynAct attacks.
- We've built a list of the best ransomware protection (opens in new tab) available
- Keep your devices virus free with the best malware removal software (opens in new tab)
- Also check out our roundup of the best antivirus (opens in new tab) software
Unfortunately for SynAct victims, decrypting the cybercriminals' ransomware is somewhat complicated for non-technical users. Thankfully though, Emsisoft plans on releasing its own decryption utility in the next few days which will not only be easier to user but will also be safer.
The SynAck ransomware group was first identified back in July of 2017 though the group quickly rose to prominence due to its encryption routines and the way in which it used process doppelganging to evade being detected by antivirus software (opens in new tab).
Although the group continued to operate during the following years, it was soon overshadowed by larger ransomware groups including, REvil (opens in new tab), Ryuk (opens in new tab) and BitPaymer (opens in new tab).
The reason the group decided to release the master decryption keys for its old victims is because it is in the process of winding down its SynAck operation as it ramps up work on its new ransomware strain, El_Cometa.
While the group has worked with outside partners in the past to distribute its ransomware, it now plans to expand its operational model by launching a new Ransomware-as-a-Service (RaaS (opens in new tab)) platform and recruiting new partners or affiliates to carry out its attacks.
Expect the El_Cometa ransomware strain to infect additional victims as the cybercriminals behind it expand their operations.
- We've also highlighted the best endpoint protection software (opens in new tab)
Via The Record (opens in new tab)