Avaddon ransomware gang shuts down and releases decryption keys

Members of the notorious ransomware group Avaddon have released decryption keys amid reports that the gang is shutting down.

The news comes just weeks after Avaddon targeted one of the Asian business units of French insurance group AXA, impacting its IT operations and stealing 3TB of data.

However, the hacking group seems to be ready to withdraw from the world of cyber crime, having emailed BleepingComputer 2,934 decryption keys, with each key corresponding to a single victim. The legitimacy of the decryptor was confirmed by security specialists from Emsisoft, which also published a freely accessible version on the software its website, alongside a detailed guide for the victims.

Avaddon's decision to release the decryptor was interpreted as a sign that the ransomware gang was finally suspending its operations. Emsisoft threat analyst Brett Callow had a simple message for the now-retired hackers: "Good riddance."

"Avaddon's victims were many and varied, including AXA, Dade City, Valley National Bank, Presque Isle Police Department, Labor NSW, and the National AIDS Control Council of Kenya," he told IT Pro.

Avaddon is the latest hacking group to have reportedly suspended operations, following similar announcements from the Colonial Pipeline hackers DarkSide and Maze, whose victims included Canon, Xerox, VT San Antonio Aerospace, MaxLinear, and Cognizant.

In a press release obtained by cyber security expert Graham Cluley, members of the Maze collective, which was one of the two most frequentently used ransomware strains of 2020, announced that "the Project is closed",

However, despite this, ransomware attacks are still on the rise, with Egregor ransomware said to be filling the gap. In February, the strain was ranked in the top 10 for detected infections despite only being detected for the first time in September 2020.

The research, conducted by Trend Micro, discovered 127 new ransomware families in 2020 - 34% more than it found in 2019. Despite Egregor's success, 2017's WannaCry is still the most-detected malware family by far, with 220,166 detections infected. The next most popular was Locky, with just 15,816 cases.

Meanwhile, the hacking group Ryuk, which was found to be behind a third of all ransomware attacks in 2020, has not shown any signs of retiring anytime soon.