www.bleepingcomputer.com
Open in
urlscan Pro
104.20.59.209
Public Scan
Submitted URL: http://www.bleepingcomputer.com/news/security/avaddon-ransomware-shuts-down-and-releases-decryption-keys/
Effective URL: https://www.bleepingcomputer.com/news/security/avaddon-ransomware-shuts-down-and-releases-decryption-keys/
Submission: On April 11 via api from US — Scanned from DE
Effective URL: https://www.bleepingcomputer.com/news/security/avaddon-ransomware-shuts-down-and-releases-decryption-keys/
Submission: On April 11 via api from US — Scanned from DE
Form analysis 6 forms found in the DOM
https://www.bleepingcomputer.com/search/
<form title="Search site" action="https://www.bleepingcomputer.com/search/">
<input type="hidden" name="cx" value="partner-pub-0920899300397823:3529943228">
<input type="hidden" name="cof" value="FORID:10">
<input type="hidden" name="ie" value="UTF-8">
<input type="search" name="q" aria-label="Search Site" placeholder="Search Site">
</form>https://www.bleepingcomputer.com/search/
<form action="https://www.bleepingcomputer.com/search/">
<input type="hidden" name="cx" value="partner-pub-0920899300397823:3529943228">
<input type="hidden" name="cof" value="FORID:10">
<input type="hidden" name="ie" value="UTF-8">
<input type="search" name="q" aria-label="Search Site" placeholder="Search Site">
</form>POST //bleepingcomputer.us10.list-manage.com/subscribe/post?u=3e2b3b692f780cdff40d45346&id=30c98e654e
<form action="//bleepingcomputer.us10.list-manage.com/subscribe/post?u=3e2b3b692f780cdff40d45346&id=30c98e654e" method="post" target="_blank" novalidate="">
<input type="email" name="EMAIL" aria-label="Enter email address" placeholder="Email Address...">
<div style="position: absolute; left: -5000px;"><input type="hidden" aria-hidden="true" name="b_3e2b3b692f780cdff40d45346_30c98e654e" tabindex="-1" value=""></div>
<input type="submit" value="Submit" class="bc_sub_btn">
</form>POST //bleepingcomputer.us10.list-manage.com/subscribe/post?u=3e2b3b692f780cdff40d45346&id=30c98e654e
<form action="//bleepingcomputer.us10.list-manage.com/subscribe/post?u=3e2b3b692f780cdff40d45346&id=30c98e654e" method="post" target="_blank" novalidate="">
<input type="email" aria-label="Enter email address" name="EMAIL" placeholder="Email Address...">
<div style="position: absolute; left: -5000px;"><input type="hidden" aria-hidden="true" name="b_3e2b3b692f780cdff40d45346_30c98e654e" tabindex="-1" value=""></div>
<input type="submit" value="Submit" class="bc_sub_btn">
</form>POST https://www.bleepingcomputer.com/forums/index.php?app=core&module=global§ion=login&do=process&return=https://www.bleepingcomputer.com/news/security/avaddon-ransomware-shuts-down-and-releases-decryption-keys/
<form action="https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=login&do=process&return=https://www.bleepingcomputer.com/news/security/avaddon-ransomware-shuts-down-and-releases-decryption-keys/"
method="post">
<div class="bc_form_feild">
<label for="ips_username">Username</label>
<input aria-label="Enter login name" title="Enter login name" type="text" id="ips_username" name="ips_username" autocomplete="username">
</div>
<div class="bc_form_feild">
<label for="ips_password">Password</label>
<input aria-label="Enter login password" title="Enter login passwod" type="password" id="ips_password" name="ips_password" autocomplete="current-password">
</div>
<div class="bc_form_feild">
<div class="bc_remember">
<input id="remember" type="checkbox" name="rememberMe" value="1" checked="checked">
<label for="remember">Remember Me</label>
</div>
<div class="bc_anon">
<input id="anonymous" type="checkbox" name="anonymous" value="1">
<label for="anonymous">Sign in anonymously</label>
</div>
</div>
<div class="bc_btn_wrap">
<input type="hidden" name="auth_key" value="880ea6a14ea49e853634fbdc5015a024">
<input type="submit" aria-label="Login to site" title="Login" value="Login" class="bc_sub_btn">
<a aria-label="Sign in with Twitter" href="https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=login&serviceClick=twitter&return=https://www.bleepingcomputer.com/news/security/avaddon-ransomware-shuts-down-and-releases-decryption-keys/" class="bc_twitter_btn"><img src="https://www.bleepstatic.com/images/site/login/twitter.png" width="28" height="24" alt="Sign in with Twitter button"> Sign in with Twitter</a>
<hr>
<p>Not a member yet? <a aria-label="Register account" title="Register account" href="https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=register">Register Now</a></p>
</div>
</form><form>
<input type="hidden" id="comment-id-report" value="0">
<ul>
<li>
<label><input type="radio" name="comment-report-reason" value="Spam">Spam</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Abusive or Harmful">Abusive or Harmful</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Inappropriate content">Inappropriate content</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Strong language">Strong language</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Other">Other</label>
</li>
<li id="comment-report-other-reason-wrap" style="display:none;">
<textarea aria-label="Enter other reason for reporting the comment" rows="2" cols="2" id="comment-report-other-reason"></textarea>
</li>
</ul>
<p>Read our <a href="https://www.bleepingcomputer.com/posting-guidelines/">posting guidelinese</a> to learn what content is prohibited.</p>
</form>Text Content
WE VALUE YOUR PRIVACY
We and our partners store and/or access information on a device, such as cookies
and process personal data, such as unique identifiers and standard information
sent by a device for personalised ads and content, ad and content measurement,
and audience insights, as well as to develop and improve products.
With your permission we and our partners may use precise geolocation data and
identification through device scanning. You may click to consent to our and our
partners’ processing as described above. Alternatively you may access more
detailed information and change your preferences before consenting or to refuse
consenting. Please note that some processing of your personal data may not
require your consent, but you have a right to object to such processing. Your
preferences will apply to this website only. You can change your preferences at
any time by returning to this site or visit our privacy policy.
MORE OPTIONSAGREE
*
*
*
*
*
*
* News
* Featured
* Latest
* Hackers use Conti's leaked ransomware to attack Russian companies
* Microsoft Edge gets performance boost with updated sleeping tabs
* New Meta information stealer distributed in malspam campaign
* Microsoft: Windows 10 20H2 reaches end of service next month
* Here are the new features coming to Windows 11
* Hone your cloud skills with this Microsoft Azure training bundle deal
* New Meta information stealer distributed in malspam campaign
* Microsoft Edge gets performance boost with updated sleeping tabs
* Downloads
* Latest
* Most Downloaded
* Qualys BrowserCheck
* STOPDecrypter
* AuroraDecrypter
* FilesLockerDecrypter
* AdwCleaner
* ComboFix
* RKill
* Junkware Removal Tool
* Virus Removal Guides
* Latest
* Most Viewed
* Ransomware
* How to remove the PBlock+ adware browser extension
* Remove the Toksearches.xyz Search Redirect
* Remove the Smashapps.net Search Redirect
* Remove the Smashappsearch.com Search Redirect
* Remove Security Tool and SecurityTool (Uninstall Guide)
* How to remove Antivirus 2009 (Uninstall Instructions)
* How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo
* How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using
TDSSKiller
* Locky Ransomware Information, Help Guide, and FAQ
* CryptoLocker Ransomware Information Guide and FAQ
* CryptorBit and HowDecrypt Information Guide and FAQ
* CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ
* Tutorials
* Latest
* Popular
* How to make the Start menu full screen in Windows 10
* How to install the Microsoft Visual C++ 2015 Runtime
* How to open an elevated PowerShell Admin prompt in Windows 10
* How to Translate a Web Page in Google Chrome
* How to start Windows in Safe Mode
* How to remove a Trojan, Virus, Worm, or other Malware
* How to show hidden files in Windows 7
* How to see hidden files in Windows
* Deals
* Categories
* eLearning
* IT Certification Courses
* Gear + Gadgets
* Security
* Forums
* More
* Startup Database
* Uninstall Database
* File Database
* Glossary
* Chat on Discord
* Send us a Tip!
* Welcome Guide
* Home
* News
* Security
* Avaddon ransomware shuts down and releases decryption keys
* AddThis Sharing Buttons
Share to FacebookFacebookShare to TwitterTwitterShare to
LinkedInLinkedInShare to RedditRedditShare to Hacker NewsHacker NewsShare to
EmailEmail
*
AVADDON RANSOMWARE SHUTS DOWN AND RELEASES DECRYPTION KEYS
By
LAWRENCE ABRAMS
* June 11, 2021
* 12:10 PM
* 9
The Avaddon ransomware gang has shut down operation and released the decryption
keys for their victims to BleepingComputer.com.
This morning, BleepingComputer received an anonymous tip pretending to be from
the FBI that contained a password and a link to a password-protected ZIP file.
This file claimed to be the "Decryption Keys Ransomware Avaddon," and contained
the three files shown below.
PLAY Top Articles Video Settings Full Screen About Connatix V158273 Read More
Read More Read More Read More Read More Read More Here are the new features
coming toWindows 11 1/1 Skip Ad Continue watching after the ad Visit Advertiser
websiteGO TO PAGE
Avaddon decryption keys shared with BleepingComputer
After sharing the files with Fabian Wosar of Emsisoft and Michael Gillespie of
Coveware, they confirmed that the keys are legitimate.
Using a test decryptor shared with BleepingComputer by Emsisoft, I decrypted a
virtual machine encrypted today with a recent sample of Avaddon.
Decrypting Avaddon encrypted files with released keys
In total, the threat actors sent us 2,934 decryption keys, where each key
corresponds to a specific victim.
Emsisoft has released a free decryptor that all victims can use to recover their
files for free.
While it doesn't happen often enough, ransomware groups have previously released
decryption keys to BleepingComputer and other researchers as a gesture of
goodwill when they shut down or release a new version.
In the past, decryption keys have been released for TeslaCrypt, Crysis, AES-NI,
Shade, FilesLocker, Ziggy, and FonixLocker.
AVADDON SHUTS DOWN RANSOMWARE OPERATION
Avaddon launched its operation in June 2020 through a phishing campaign that
contained a winking smiley, shown below.
Avaddon phishing email
Over time, Avaddon has grown into one of the larger ransomware operations, with
the FBI and Australian law enforcement recently releasing advisories related to
the group.
At this time, all of Avaddon's Tor sites are inaccessible, indicating that the
ransomware operation has likely shut down.
Furthermore, ransomware negotiation firms and incident responders saw a mad rush
by Avaddon over the past few days to finalize ransom payments from existing
unpaid victims.
Coveware CEO Bill Siegel has told BleepingComputer that Avaddon's average ransom
demand was around $600k.
However, over the past few days, Avaddon has been pressuring victims to pay and
accepting the last counteroffer without any push back, which Siegel states is
abnormal.
It is not clear why Avaddon shut down, but it was likely caused by the increased
pressure and scrutiny by law enforcement and governments worldwide after recent
attacks against critical infrastructure.
"The recent actions by law enforcement have made some threat actors nervous:
this is the result. One down, and let’s hope some others go down too," Emsisoft
threat analyst Brett Callow told BleepingComputer.
With the recent attacks against Colonial Pipeline and JBS, ransomware has become
a priority of the US government.
As most of the larger ransomware operations are believed to be operated within
Russia or other CIS countries, President Biden will be discussing these recent
ransomware attacks with Russian President Vladimir Putin at the June 16 Geneva
summit.
Update 6/11/21: Added link to free Avaddon decryptor.
RELATED ARTICLES:
REvil ransomware member extradited to U.S. to stand trial for Kaseya attack
The Week in Ransomware - February 11th 2022 - Maze, Egregor decryptors
Hackers use Conti's leaked ransomware to attack Russian companies
NFL's San Francisco 49ers hit by Blackbyte ransomware attack
Snap-on discloses data breach claimed by Conti ransomware gang
* Avaddon
* Decryption Key
* Ransomware
* Facebook
* Twitter
* LinkedIn
* Email
*
LAWRENCE ABRAMS
Lawrence Abrams is the owner and Editor in Chief of BleepingComputer.com.
Lawrence's area of expertise includes Windows, malware removal, and computer
forensics. Lawrence Abrams is a co-author of the Winternals Defragmentation,
Recovery, and Administration Field Guide and the technical editor for Rootkits
for Dummies.
* Previous Article
* Next Article
COMMENTS
* CALLMEMUSASHI - 9 MONTHS AGO
*
*
Drat, was hoping this was for the QNAP qlocker ransomware. Still, nice to see
some rare good news on this front!
* PARYAL - 9 MONTHS AGO
*
*
what about IGVM
* PARYAL - 9 MONTHS AGO
*
*
what about IGVM
* DOGSOFHELLFIRE2600 - 9 MONTHS AGO
*
*
Good job on this story and thanks for providing such an invaluable service to
everyone affected. Bleepingcomputer Team rocks. Thanks Mr. Abrams.
* VLADMICHAELS1953 - 9 MONTHS AGO
*
*
Thanks for story and news. Unfortunately decryptor did not work for us. Is
there another version coming out? How we can check if our code/keys are in
decryptor program?
* LAWRENCE ABRAMS - 9 MONTHS AGO
*
*
Unfortunately, those are all the keys they sent us.
* VLADMICHAELS1953 - 9 MONTHS AGO
*
*
New version works now - thanks everyone!
* TANGO_CHARLIE - 9 MONTHS AGO
*
*
We don't have to guess...Mr. Putler calls his dogs off:
FACT 1: President Biden will be discussing these recent ransomware attacks
with Russian President Vladimir Putin at the June 16 Geneva summit.
FACT 2: The Avaddon ransomware gang has shut down operation and released the
decryption keys for their victims
* PUTXEMPODERADX - 9 MONTHS AGO
*
*
Mi ID sigue sin funcionar con esta nueva versión sigue diciéndome que tengo
una clave ONLINE. Mis archivos estan en .paas
POST A COMMENT COMMUNITY RULES
YOU NEED TO LOGIN IN ORDER TO POST A COMMENT
Not a member yet? Register Now
YOU MAY ALSO LIKE:
Popular Stories
* Microsoft: Windows Autopatch steals the 'fun' from Patch Tuesdays
* New Android banking malware remotely takes control of your device
NEWSLETTER SIGN UP
To receive periodic updates and news from BleepingComputer, please use the form
below.
Latest Downloads
* Malwarebytes Anti-Malware
Version: 4.5.2
4M+ Downloads
* Malwarebytes for Mac
Version: 4.14
35,278 Downloads
* Windows Repair (All In One)
Version: 4.12.4
2M+ Downloads
* AdwCleaner
Version: 8.3.1.0
56M+ Downloads
* Farbar Recovery Scan Tool
Version: NA
5M+ Downloads
NEWSLETTER SIGN UP
* Follow us:
*
*
*
*
MAIN SECTIONS
* News
* Downloads
* Virus Removal Guides
* Tutorials
* Startup Database
* Uninstall Database
* File Database
* Glossary
COMMUNITY
* Forums
* Forum Rules
* Chat
USEFUL RESOURCES
* Welcome Guide
* Sitemap
COMPANY
* About BleepingComputer
* Contact Us
* Send us a Tip!
* Advertising
* Write for BleepingComputer
* Social & Feeds
* Changelog
Terms of Use - Privacy Policy - Ethics Statement
Copyright @ 2003 - 2022 Bleeping Computer® LLC - All Rights Reserved
LOGIN
Username
Password
Remember Me
Sign in anonymously
Sign in with Twitter
--------------------------------------------------------------------------------
Not a member yet? Register Now
REPORTER
HELP US UNDERSTAND THE PROBLEM. WHAT IS GOING ON WITH THIS COMMENT?
* Spam
* Abusive or Harmful
* Inappropriate content
* Strong language
* Other
*
Read our posting guidelinese to learn what content is prohibited.
Submitting...
SUBMIT