Ransomware gang offers to refund victims' payments

Hackers have requested that victims contact them via email with proof of payment

The prolific Ziggy ransomware gang has announced that it will start refunding ransom payments to its victims, following the group’s decision to cease operations.

The administrator of the gang’s operations had hinted about the idea on 19 March, saying that they were looking to return the payments to those who had paid ransoms. Making payments to ransomware groups in an attempt to recover encrypted or stolen data is generally not advised and might even lead to prosecution.

However, according to statements seen by BleepingComputer, the group announced their retirement from cyber crime on 6 February, with the administrator of the operation expressing regret about their actions and announcing that they had “decided to publish all decryption keys” to the affected systems.

The next day, they shared a SQL file containing 922 decryption keys which could be used by their victims to regain access to their data. The Ziggy administrator also provided the victims with a decryption tool, as well as the source code for a decryptor that doesn’t require access to an internet network.

Related Resource

Managing security risk and compliance in a challenging landscape

How key technology partners grow with your organisation

How to manage security risk and compliance - whitepaperDownload now

Almost two months later, the Ziggy group is now also offering to return the ransom payments, with victims asked to contact the gang’s admin at ziggyransomware@secmail.pro and attach proof of payment as well as their computer ID. According to the hackers, the money will be returned to the victim’s Bitcoin wallet within two weeks.

However, it's worth noting that currently there is little evidence to suggest that the money will in fact be returned.

Despite offering to return the paid ransoms, the Ziggy group will still be profiting from the cyber attacks due to the payments being made in Bitcoin. It appears that hackers will return only the value of the ransom at the time of payment, rather than the quantity of bitcoin paid - a cryptocurrency that has surged in value in recent months.

On 7 February, when the decryption keys were made public, the price of one Bitcoin was around £28,000. At the time of writing, it is valued at over £41,000.

Featured Resources

2021 Thales cloud security study

The challenges of cloud data protection and access management in a hybrid and multi cloud world

Free download

IDC agility assessment

The competitive advantage in adaptability

Free Download

Digital transformation insights from CIOs for CIOs

Transformation pilotes, co-pilots, and engineers

Free download

What ITDMs did next - and what they should be doing now

Enable continued collaboration and communication for hybrid workers

Recommended

Sabbath hackers are targeting US schools and hospitals
ransomware

Sabbath hackers are targeting US schools and hospitals

29 Nov 2021
US government warns of increased risk of ransomware over holiday season
ransomware

US government warns of increased risk of ransomware over holiday season

24 Nov 2021
Out-of-hours ransomware attacks have a greater impact on revenue
ransomware

Out-of-hours ransomware attacks have a greater impact on revenue

18 Nov 2021
US and Israel join forces to fight ransomware
ransomware

US and Israel join forces to fight ransomware

15 Nov 2021

Most Popular

Microsoft 365 prices to soar by 20% for pay monthly subscribers
Managed service provider (MSP)

Microsoft 365 prices to soar by 20% for pay monthly subscribers

7 Dec 2021
What are the pros and cons of AI?
machine learning

What are the pros and cons of AI?

30 Nov 2021
What is single sign-on (SSO)?
single sign-on (SSO)

What is single sign-on (SSO)?

2 Dec 2021