Pierluigi Paganini January 30, 2021

FonixCrypter ransomware operators shut down their operations, released the master decryption key for free, and deleted malware’s source code.

Good news for the victims of the FonixCrypter ransomware, the operators behind the threat shut down their operations and released the master decryption key. The FonixCrypter gang also closed its Telegram channel that was used to advertise the malware in the cybercrime underground. The availability of the master decryption key allows the victims to recover their encrypted files for free.

The FonixCrypter ransomware operators also deleted the ransomware’s source code as their claim in a message published on Twitter:

The FonixCrypter operators also released containing a decryption tool and the master decryption key, along with instructions to recover the files.

Experts who tested the decryption tool confirmed that it works and allows to recover encrypted files for free. It is expected that some experts could use the package released by the gang to build an easy to use and effective decryption tool.

Unfortunately, at the time of writing the RAR archive is not available.

The popular Emsisoft security researcher Michael Gillespie told ZDNet that his company is working on a decrypted and suggested avoiding use the one provided by the FonixCrypter gang due to the possibility that its code could hide a backdoor.

Michael Gillespie also told BleepingComputer that the master keys work but only on some Fonix ransomware versions, including the ones that append .Fonix, .FONIX, .repter, .XINOF extensions to filenames of encrypted files.

The FonixCrypter ransomware gang has been active since at least June 2020, it was available with a ransomware-as-a-service model.

This ransomware encrypts user files using Salsa + RSA, and provides victims an email address to receive the instructions to pay the ransom. The ransomware received multiple updates over time.

The security researcher Andrew Ivanov published technical details about this specific threat in a blog post.

If you want to receive the weekly Security Affairs Newsletter for free subscribe here.

Pierluigi Paganini

(SecurityAffairs – hacking, ransomware)

[adrotate banner=”5″]

[adrotate banner=”13″]