Avaddon ransomware shuts down and releases decryption keys

The Avaddon ransomware gang has shut down procedure and unveiled the decryption keys for their victims to BleepingComputer.com.

This early morning, BleepingComputer acquired an anonymous tip pretending to be from the FBI that contained a password and a link to a password-shielded ZIP file.

This file claimed to be the “Decryption Keys Ransomware Avaddon,” and contained the three files proven below.

Following sharing the data files with Fabian Wosar of Emsisoft and Michael Gillespie of Coveware, they confirmed that the keys are authentic.

Making use of a examination decryptor shared with BleepingComputer by Emsisoft, I decrypted a virtual machine encrypted now with a recent sample of Avaddon.

In complete, the risk actors despatched us 2,934 decryption keys, where each individual vital corresponds to a certain target.

Emsisoft has introduced a no cost decryptor that all victims can use to recuperate their files for no cost.

Whilst it doesn’t occur typically ample, ransomware groups have formerly introduced decryption keys to BleepingComputer and other researchers as a gesture of goodwill when they shut down or release a new variation.

In the past, decryption keys have been produced for TeslaCrypt, Crysis, AES-NI, Shade, FilesLocker, Ziggy, and FonixLocker.

Avaddon shuts down ransomware procedure

Avaddon introduced its procedure in June 2020 via a phishing campaign that contained a winking smiley, demonstrated under.

About time, Avaddon has developed into one of the greater ransomware functions, with the FBI and Australian legislation enforcement lately releasing advisories relevant to the group.

At this time, all of Avaddon’s Tor sites are inaccessible, indicating that the ransomware operation has most likely shut down.

Also, ransomware negotiation corporations and incident responders saw a mad rush by Avaddon above the previous couple times to finalize ransom payments from existing unpaid victims.

Coveware CEO Bill Siegel has explained to BleepingComputer that Avaddon’s common ransom desire was around $600k.

Nonetheless, around the previous handful of times, Avaddon has been pressuring victims to fork out and accepting the previous counteroffer without any thrust back again, which Siegel states is abnormal.

It is not obvious why Avaddon shut down, but it was very likely brought on by the improved pressure and scrutiny by law enforcement and governments around the world soon after the latest assaults in opposition to critical infrastructure.

“The current steps by legislation enforcement have designed some threat actors nervous: this is the consequence. A person down, and let us hope some many others go down too,” Emsisoft threat analyst Brett Callow explained to BleepingComputer.

With the current assaults from Colonial Pipeline and JBS, ransomware has turn out to be a precedence of the US authorities.

As most of the much larger ransomware operations are thought to be operated inside Russia or other CIS international locations, President Biden will be speaking about these current ransomware attacks with Russian President Vladimir Putin at the June 16 Geneva summit.

Update 6/11/21: Additional url to free of charge Avaddon decryptor.