Ransomware gang offers to refund victims' payments

Hackers have requested that victims contact them via email with proof of payment

The prolific Ziggy ransomware gang has announced that it will start refunding ransom payments to its victims, following the group’s decision to cease operations.

The administrator of the gang’s operations had hinted about the idea on 19 March, saying that they were looking to return the payments to those who had paid ransoms. Making payments to ransomware groups in an attempt to recover encrypted or stolen data is generally not advised and might even lead to prosecution.

However, according to statements seen by BleepingComputer, the group announced their retirement from cyber crime on 6 February, with the administrator of the operation expressing regret about their actions and announcing that they had “decided to publish all decryption keys” to the affected systems.

The next day, they shared a SQL file containing 922 decryption keys which could be used by their victims to regain access to their data. The Ziggy administrator also provided the victims with a decryption tool, as well as the source code for a decryptor that doesn’t require access to an internet network.

Related Resource

Managing security risk and compliance in a challenging landscape

How key technology partners grow with your organisation

How to manage security risk and compliance - whitepaperDownload now

Almost two months later, the Ziggy group is now also offering to return the ransom payments, with victims asked to contact the gang’s admin at ziggyransomware@secmail.pro and attach proof of payment as well as their computer ID. According to the hackers, the money will be returned to the victim’s Bitcoin wallet within two weeks.

However, it's worth noting that currently there is little evidence to suggest that the money will in fact be returned.

Despite offering to return the paid ransoms, the Ziggy group will still be profiting from the cyber attacks due to the payments being made in Bitcoin. It appears that hackers will return only the value of the ransom at the time of payment, rather than the quantity of bitcoin paid - a cryptocurrency that has surged in value in recent months.

On 7 February, when the decryption keys were made public, the price of one Bitcoin was around £28,000. At the time of writing, it is valued at over £41,000.

Featured Resources

Consumer choice and the payment experience

A software provider's guide to getting, growing, and keeping customers

Download now

Prevent fraud and phishing attacks with DMARC

How to use domain-based message authentication, reporting, and conformance for email security

Download now

Business in the new economy landscape

How we coped with 2020 and looking ahead to a brighter 2021

Download now

How to increase cyber resilience within your organisation

Cyber resilience for dummies

Download now

Recommended

Georgia fertility clinic breach exposes sensitive patient info
ransomware

Georgia fertility clinic breach exposes sensitive patient info

21 Jun 2021
Ransomware criminals look to other hackers to provide them with network access
ransomware

Ransomware criminals look to other hackers to provide them with network access

17 Jun 2021
Four in five ransomware victims suffer repeat attacks
ransomware

Four in five ransomware victims suffer repeat attacks

16 Jun 2021
FBI still frowns on ransomware payments
ransomware

FBI still frowns on ransomware payments

11 Jun 2021

Most Popular

Best paying tech jobs of 2021
Careers & training

Best paying tech jobs of 2021

7 Jun 2021
Ten-year-old iOS 4 recreated as an iPhone app
iOS

Ten-year-old iOS 4 recreated as an iPhone app

10 Jun 2021
Mythic launches power-sipping AI chip
Hardware

Mythic launches power-sipping AI chip

8 Jun 2021