SynAck ransomware group releases decryption keys, but new strain in the works

(Image credit: Future) 

The SynAck ransomware group, which recently changed its name to El_Cometa, has released the master decryption keys to its ransomware that was used to infect victims from 2017 to early 2021.

In a new exclusive report from The Record, the news outlet has reported that the keys have now been verified as authentic by creator of the ID Ransomware service and malware analyst at Emsisoft, Micheal Gillespie. Gillespie confirmed the authenticity of the master decryption keys by using them to decrypt files from previous SynAct attacks.

Unfortunately for SynAct victims, decrypting the cybercriminals' ransomware is somewhat complicated for non-technical users. Thankfully though, Emsisoft plans on releasing its own decryption utility in the next few days which will not only be easier to user but will also be safer.

El_Cometa ransomware

The SynAck ransomware group was first identified back in July of 2017 though the group quickly rose to prominence due to its encryption routines and the way in which it used process doppelganging to evade being detected by antivirus software.

Although the group continued to operate during the following years, it was soon overshadowed by larger ransomware groups including, REvil, Ryuk and BitPaymer.

The reason the group decided to release the master decryption keys for its old victims is because it is in the process of winding down its SynAck operation as it ramps up work on its new ransomware strain, El_Cometa.

While the group has worked with outside partners in the past to distribute its ransomware, it now plans to expand its operational model by launching a new Ransomware-as-a-Service (RaaS) platform and recruiting new partners or affiliates to carry out its attacks.

Expect the El_Cometa ransomware strain to infect additional victims as the cybercriminals behind it expand their operations.