[BreachExchange] Ziggy ransomware shuts down and releases victims' decryption keys

[Destry Winant]

https://www.bleepingcomputer.com/news/security/ziggy-ransomware-shuts-down-and-releases-victims-decryption-keys/

The Ziggy ransomware operation has shut down and released the victims'
decryption keys after concerns about recent law enforcement activity
and guilt for encrypting victims.

Over the weekend, security researcher M. Shahpasandi told
BleepingComputer that the Ziggy Ransomware admin announced on Telegram
that they were shutting down their operation and would be releasing
all of the decryption keys.

Shut down announcement by Ziggy admin

In an interview with BleepingComputer, the ransomware admin said they
created the ransomware to generate money as they live in a
"third-world country."

After feeling guilty about their actions and concerns over recent law
enforcement operations against Emotet and Netwalker ransomware, the
admin decided to shut down and release all of the keys.

Today, the Ziggy ransomware admin posted a SQL file containing 922
decryption keys for encrypted victims. For each victim, the SQL file
lists three keys needed to decrypt their encrypted files.

SQL file containing Ziggy decryption keys

The ransomware admin also posted a decryptor [VirusTotal] that victims
can use with the keys listed in the SQL file.

Ziggy ransomware decryptor

In addition to the decryptor and the SQL file, the ransomware admin
shared the source code for a different decryptor with BleepingComputer
that contains offline decryption keys.

Ransomware infections use offline decryption keys to decrypt victims
infected while not being connected to the Internet or the command and
control server was unreachable.

Source code for different Ziggy ransomware decryptor

The ransomware admin also shared these files with ransomware expert
Michael Gillespie who created a decryptor for the Ziggy Ransomware
using the released keys.

Emsisoft's Ziggy ransomware decryptor

While the ransomware admin appears to be honest in their intent to
shut down and release the keys, BleepingComputer always suggests using
a security company's decryptor rather than one supplied by a threat
actor.

"The release of the keys, whether voluntarily or involuntarily, is the
best possible outcome. It means past victims can recover their data
without needing to pay the ransom or use the dev’s decryptor, which
could contain a backdoor and/or bugs. And, of course, it also means
there’s one less ransomware group to worry about."

"The recent arrest of individuals associated with the Emotet and
Netwalker operation could be causing some actors to get cold feet. If
so, we could well see more groups ceasing operations and handing over
the their keys. Fingers crossed," Emsisoft's Brett Callow told
BleepingComputer.

Last week, the Fonix ransomware operation also shut down and released
keys and decryptor. The Ziggy admin told BleepingComputer that they
are friends with the Fonix ransomware group and are from the same
country.

Update /2/8/21: Added information about released Ziggy decryptor.