Good news for the victims of the FonixCrypter ransomware, the operators behind the threat shut down their operations and released the master decryption key. The FonixCrypter gang also closed its Telegram channel that was used to advertise the malware in the cybercrime underground. The availability of the master decryption key allows the victims to recover their encrypted files for free.
The FonixCrypter ransomware operators also deleted the ransomware’s source code as their claim in a message published on Twitter:
The FonixCrypter operators also released containing a decryption tool and the master decryption key, along with instructions to recover the files.
Experts who tested the decryption tool confirmed that it works and allows to recover encrypted files for free. It is expected that some experts could use the package released by the gang to build an easy to use and effective decryption tool.
Unfortunately, at the time of writing the RAR archive is not available.
The popular Emsisoft security researcher Michael Gillespie told ZDNet that his company is working on a decrypted and suggested avoiding use the one provided by the FonixCrypter gang due to the possibility that its code could hide a backdoor.
Michael Gillespie also told BleepingComputer that the master keys work but only on some Fonix ransomware versions, including the ones that append .Fonix, .FONIX, .repter, .XINOF extensions to filenames of encrypted files.
The FonixCrypter ransomware gang has been active since at least June 2020, it was available with a ransomware-as-a-service model.
This ransomware encrypts user files using Salsa + RSA, and provides victims an email address to receive the instructions to pay the ransom. The ransomware received multiple updates over time.
If you want to receive the weekly Security Affairs Newsletter for free subscribe here.
(SecurityAffairs – hacking, ransomware)
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.