The Avaddon ransomware gang has shut down operation and released the decryption keys for their victims to BleepingComputer.com.
This morning, BleepingComputer received an anonymous tip pretending to be from the FBI that contained a password and a link to a password-protected ZIP file.
This file claimed to be the “Decryption Keys Ransomware Avaddon,” and contained the three files shown below.
While it doesn’t happen often enough, ransomware groups have previously released decryption keys to BleepingComputer and other researchers as a gesture of goodwill when they shut down or release a new version.
At this time, all of Avaddon’s Tor sites are inaccessible, indicating that the ransomware operation has likely shut down.
Furthermore, ransomware negotiation firms and incident responders saw a mad rush by Avaddon over the past few days to finalize ransom payments from existing unpaid victims.
Coveware CEO Bill Siegel has told BleepingComputer that Avaddon’s average ransom demand was around $600k.
However, over the past few days, Avaddon has been pressuring victims to pay and accepting the last counteroffer without any push back, which Siegel states is abnormal.
It is not clear why Avaddon shut down, but it was likely caused by the increased pressure and scrutiny by law enforcement and governments worldwide after recent attacks against critical infrastructure.
“The recent actions by law enforcement have made some threat actors nervous: this is the result. One down, and let’s hope some others go down too,” Emsisoft threat analyst Brett Callow told BleepingComputer.
With the recent attacks against Colonial Pipeline and JBS, ransomware has become a priority of the US government.
As most of the larger ransomware operations are believed to be operated within Russia or other CIS countries, President Biden will be discussing these recent ransomware attacks with Russian President Vladimir Putin at the June 16 Geneva summit.