Hackers retire Troldesh ransomware and release 750,000 decryption keys
The team behind the malware has mysteriously shut it down just months after spearheading an explosion in activity
A prominent hacking outfit that deployed the ransomware known as Shade, or Troldesh, to devastating effect has “irrevocably destroyed” the Trojan and released 750,000 decryption keys.
The cyber criminals behind the malware confirmed they retired the prominent ransomware towards the end of last year after six years of activity and have apologised to victims, offering no explanation as to why. An expert with Kaspersky has confirmed the decryption keys as being genuine.
The Trojan, which made up 6% of all ransomware attacks in 2017, experienced a massive increase in detections from the fourth quarter of 2018 to the first quarter of 2019, spiking in February last year, according to Malwarebytes. This was among the most, if not the most, widely distributed malware in the first half of the year.
Those spearheading Troldesh campaigns, however, have now unexpectedly released 750,000 decryption keys, as well as its “decryption soft”, in the hope that cyber security companies can develop intuitive decryption tools.
“We are the team which created a trojan-encryptor mostly known as Shade, Troldesh or Encoder.858. In fact, we stopped its distribution in the end of 2019,” the now-former hackers said in a GitHub post. “Now we made a decision to put the last point in this story and to publish all the decryption keys we have (over 750 thousands at all).
“All other data related to our activity (including the source codes of the trojan) was irrevocably destroyed. We apologize to all the victims of the trojan and hope that the keys we published will help them to recover their data.”
RELATED RESOURCE
Decade of the RATs - remote access trojans
Cross-platform APT espionage attacks targeting Linux, Windows and Android
Troldesh typically spread through malicious email attachments, normally zip files presented as something the victim must open quickly. The extracted zip was a Javasript that then downloaded the payload, which was hosted on sites with a compromised content management system (CMS).
The ransomware is thought to have been organised by Russian hackers, given the notes were often written in both English and Russian.
The cyber criminal group has offered no explanation as to why it decided to shut down its ransomware towards the end of 2019.
It’s impossible not to draw associations with the fact that Troldesh activity exploded suddenly and exponentially earlier in the year, well beyond recorded levels since it was first spotted in 2014.
-
Can enterprises transform through startup theory?In-depth For big corporations, the flexibility, adaptability, and speed of a startup or scale-up is often the total opposite of what’s possible within their own operations
-
AI is creating more software flaws – and they're getting worseNews A CodeRabbit study compared pull requests with AI and without, finding AI is fast but highly error prone
-
15-year-old revealed as key player in Scattered LAPSUS$ HuntersNews 'Rey' says he's trying to leave Scattered LAPSUS$ Hunters and is prepared to cooperate with law enforcement
-
The Scattered Lapsus$ Hunters group is targeting Zendesk customers – here’s what you need to knowNews The group appears to be infecting support and help-desk personnel with remote access trojans and other forms of malware
-
Impact of Asahi cyber attack laid bare as company confirms 1.5 million customers exposedNews No ransom has been paid, said president and group CEO Atsushi Katsuki, and the company is restoring its systems
-
The US, UK, and Australia just imposed sanctions on a Russian cyber crime group – 'we are exposing their dark networks and going after those responsible'News Media Land offers 'bulletproof' hosting services used for ransomware and DDoS attacks around the world
-
A notorious ransomware group is spreading fake Microsoft Teams ads to snare victimsNews The Rhysida ransomware group is leveraging Trusted Signing from Microsoft to lend plausibility to its activities
-
Volkswagen confirms security ‘incident’ amid ransomware breach claimsNews Volkswagen has confirmed a security "incident" has occurred, but insists no IT systems have been compromised.
-
The number of ransomware groups rockets as new, smaller players emergeNews The good news is that the number of victims remains steady
-
Teens arrested over nursery chain Kido hacknews The ransom attack caused widespread shock when the hackers published children's personal data
