• Office Hours : 08:00 - 17:30

Ransomware gang offers to refund victims’ payments

The prolific Ziggy ransomware gang has announced that it will start refunding ransom payments to its victims, following the group’s decision to cease operations.

The administrator of the gang’s operations had hinted about the idea on 19 March, saying that they were looking to return the payments to those who had paid ransoms. Making payments to ransomware groups in an attempt to recover encrypted or stolen data is generally not advised and might even lead to prosecution.

However, according to statements seen by BleepingComputer, the group announced their retirement from cyber crime on 6 February, with the administrator of the operation expressing regret about their actions and announcing that they had “decided to publish all decryption keys” to the affected systems.

The next day, they shared a SQL file containing 922 decryption keys which could be used by their victims to regain access to their data. The Ziggy administrator also provided the victims with a decryption tool, as well as the source code for a decryptor that doesn’t require access to an internet network.

Related Resource

Managing security risk and compliance in a challenging landscape

How key technology partners grow with your organisation

How to manage security risk and compliance - whitepaperHow to manage security risk and compliance - whitepaperDownload now

Almost two months later, the Ziggy group is now also offering to return the ransom payments, with victims asked to contact the gang’s admin at ziggyransomware@secmail.pro and attach proof of payment as well as their computer ID. According to the hackers, the money will be returned to the victim’s Bitcoin wallet within two weeks.

However, it’s worth noting that currently there is little evidence to suggest that the money will in fact be returned.

Despite offering to return the paid ransoms, the Ziggy group will still be profiting from the cyber attacks due to the payments being made in Bitcoin. It appears that hackers will return only the value of the ransom at the time of payment, rather than the quantity of bitcoin paid – a cryptocurrency that has surged in value in recent months.

On 7 February, when the decryption keys were made public, the price of one Bitcoin was around £28,000. At the time of writing, it is valued at over £41,000.

Featured Resources

Managing security risk and compliance in a challenging landscape

How key technology partners grow with your organisation

Download now

Security best practices for PostgreSQL

Securing data with PostgreSQL

Download now

Transform your MSP business into a money-making machine

Benefits and challenges of a recurring revenue model

Download now

The care and feeding of cloud

How to support cloud infrastructure post-migration

Watch now

See the original article here: ITPro