Ziggy ransomware shuts down and releases victims' decryption keys

The Ziggy ransomware operation has shut down and released the victims' decryption keys after concerns about recent law enforcement activity and guilt for encrypting victims.

Over the weekend, security researcher M. Shahpasandi told BleepingComputer that the Ziggy Ransomware admin announced on Telegram that they were shutting down their operation and would be releasing all of the decryption keys.

In an interview with BleepingComputer, the ransomware admin said they created the ransomware to generate money as they live in a "third-world country."

The ransomware admin also posted a decryptor [VirusTotal] that victims can use with the keys listed in the SQL file.

In addition to the decryptor and the SQL file, the ransomware admin shared the source code for a different decryptor with BleepingComputer that contains offline decryption keys.

Ransomware infections use offline decryption keys to decrypt victims infected while not being connected to the Internet or the command and control server was unreachable.

The ransomware admin also shared these files with ransomware expert Michael Gillespie who created a decryptor for the Ziggy Ransomware using the released keys.

While the ransomware admin appears to be honest in their intent to shut down and release the keys, BleepingComputer always suggests using a security company's decryptor rather than one supplied by a threat actor.

"The release of the keys, whether voluntarily or involuntarily, is the best possible outcome. It means past victims can recover their data without needing to pay the ransom or use the dev’s decryptor, which could contain a backdoor and/or bugs. And, of course, it also means there’s one less ransomware group to worry about."

"The recent arrest of individuals associated with the Emotet and Netwalker operation could be causing some actors to get cold feet. If so, we could well see more groups ceasing operations and handing over the their keys. Fingers crossed," Emsisoft's Brett Callow told BleepingComputer.

Last week, the Fonix ransomware operation also shut down and released keys and decryptor. The Ziggy admin told BleepingComputer that they are friends with the Fonix ransomware group and are from the same country.