Victims of FonixCrypter ransomware could decrypt their files for free

FonixCrypter ransomware operators shut down their operations, released the master decryption key for free, and deleted malware’s source code.

Good news for the victims of the FonixCrypter ransomware, the operators behind the threat shut down their operations and released the master decryption key. The FonixCrypter gang also closed its Telegram channel that was used to advertise the malware in the cybercrime underground. The availability of the master decryption key allows the victims to recover their encrypted files for free.

The FonixCrypter ransomware operators also deleted the ransomware’s source code as their claim in a message published on Twitter:

The FonixCrypter operators also released containing a decryption tool and the master decryption key, along with instructions to recover the files.

Experts who tested the decryption tool confirmed that it works and allows to recover encrypted files for free. It is expected that some experts could use the package released by the gang to build an easy to use and effective decryption tool.

Unfortunately, at the time of writing the RAR archive is not available.

The popular Emsisoft security researcher Michael Gillespie told ZDNet that his company is working on a decrypted and suggested avoiding use the one provided by the FonixCrypter gang due to the possibility that its code could hide a backdoor.

Michael Gillespie also told BleepingComputer that the master keys work but only on some Fonix ransomware versions, including the ones that append .Fonix, .FONIX, .repter, .XINOF extensions to filenames of encrypted files.

The FonixCrypter ransomware gang has been active since at least June 2020, it was available with a ransomware-as-a-service model.

This ransomware encrypts user files using Salsa + RSA, and provides victims an email address to receive the instructions to pay the ransom. The ransomware received multiple updates over time.

The security researcher Andrew Ivanov published technical details about this specific threat in a blog post.

If you want to receive the weekly Security Affairs Newsletter for free subscribe here.

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, ransomware)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.