The cybercrime group behind the FonixCrypter ransomware has announced today on Twitter that they’ve deleted the ransomware’s source code and plan to shut down their operation.
Fonix Ransomware Master RSA Key (Spub.key & Spriv.key) and Sample Decryptor : #Fonix #ransomware #XINOF #FonixCrypter #close_project #hack #Malware #raas #ransomware_as_a_servicehttps://t.co/JcijzvOKvf
— fnx (@fnx67482837) January 29, 2021
FonixCrypter gang has also released a package containing a decryption tool, how-to instructions, and the ransomware’s master decryption key.
These files can be used by former infected users to decrypt and recover their files for free, without needing to pay for a decryption key.
A better decrypter is currently in the works at Emsisoft and is expected to be released next week, Michael Gillespie, an Emsisoft security researcher specialized in breaking ransomware encryption, has told ZDNet earlier today in an online chat.
Last year, the Cyber-criminals gang behind the Shade Ransomware (Troldesh) has released over 750,000 decryption keys, and apologized for the harm they caused their victims. The Shade Ransomware has been in operation since around 2014. Unlike other ransomware families that specifically avoid encrypting victims in Russia and other CIS countries, Shade targets people in Russia and Ukraine predominantly.
