A prominent hacking outfit that deployed the ransomware known as Shade, or Troldesh, to devastating effect has “irrevocably destroyed” the Trojan and released 750,000 decryption keys.
The cyber criminals behind the malware confirmed they retired the prominent ransomware towards the end of last year after six years of activity and have apologised to victims, offering no explanation as to why. An expert with Kaspersky has confirmed the decryption keys as being genuine.
The Trojan, which made up 6% of all ransomware attacks in 2017, experienced a massive increase in detections from the fourth quarter of 2018 to the first quarter of 2019, spiking in February last year, according to Malwarebytes. This was among the most, if not the most, widely distributed malware in the first half of the year.
Those spearheading Troldesh campaigns, however, have now unexpectedly released 750,000 decryption keys, as well as its “decryption soft”, in the hope that cyber security companies can develop intuitive decryption tools.
“We are the team which created a trojan-encryptor mostly known as Shade, Troldesh or Encoder.858. In fact, we stopped its distribution in the end of 2019,” the now-former hackers said in a GitHub post. “Now we made a decision to put the last point in this story and to publish all the decryption keys we have (over 750 thousands at all).
“All other data related to our activity (including the source codes of the trojan) was irrevocably destroyed. We apologize to all the victims of the trojan and hope that the keys we published will help them to recover their data.”
RELATED RESOURCE
Decade of the RATs - remote access trojans
Cross-platform APT espionage attacks targeting Linux, Windows and Android
Troldesh typically spread through malicious email attachments, normally zip files presented as something the victim must open quickly. The extracted zip was a Javasript that then downloaded the payload, which was hosted on sites with a compromised content management system (CMS).
The ransomware is thought to have been organised by Russian hackers, given the notes were often written in both English and Russian.
The cyber criminal group has offered no explanation as to why it decided to shut down its ransomware towards the end of 2019.
It’s impossible not to draw associations with the fact that Troldesh activity exploded suddenly and exponentially earlier in the year, well beyond recorded levels since it was first spotted in 2014.
-
LaunchDarkly to "double down" on observability with Highlight acquisitionNews Highlight's observability tools will be integrated into LaunchDarkly's Guarded Releases software deployment service
-
Samsung Galaxy Tab S10 FE reviewReviews The Tab S10 FE retains the feel and core capabilities of Samsung's high-end S10 tablets, but compromises on the display and the performance
-
Ransomware attacks are rising — but quiet payouts could mean there's more than actually reportedNews Ransomware attacks continue to climb, but they may be even higher than official figures show as companies choose to quietly pay to make such incidents go away.
-
Cleo attack victim list grows as Hertz confirms customer data stolen – and security experts say it won't be the lastNews Hertz has confirmed it suffered a data breach as a result of the Cleo zero-day vulnerability in late 2024, with the car rental giant warning that customer data was stolen.
-
‘Phishing kits are a force multiplier': Cheap cyber crime kits can be bought on the dark web for less than $25 – and experts warn it’s lowering the barrier of entry for amateur hackersNews Research from NordVPN shows phishing kits are now widely available on the dark web and via messaging apps like Telegram, and are often selling for less than $25.
-
Healthcare systems are rife with exploits — and ransomware gangs have noticedNews Nearly nine-in-ten healthcare organizations have medical devices that are vulnerable to exploits, and ransomware groups are taking notice.
-
Alleged LockBit developer extradited to the USNews A Russian-Israeli man has been extradited to the US amid accusations of being a key LockBit ransomware developer.
-
February was the worst month on record for ransomware attacks – and one threat group had a field day
News February 2025 was the worst month on record for the number of ransomware attacks, according to new research from Bitdefender.
-
CISA issues warning over Medusa ransomware after 300 victims from critical sectors impactedNews The Medusa ransomware as a Service operation compromised twice as many organizations at the start of 2025 compared to 2024
-
Warning issued over prolific 'Ghost' ransomware groupNews The Ghost ransomware group is known to act fast and exploit vulnerabilities in public-facing appliances
