Ransomware gang offers to refund victims' payments

Hackers have requested that victims contact them via email with proof of payment

The prolific Ziggy ransomware gang has announced that it will start refunding ransom payments to its victims, following the group’s decision to cease operations.

The administrator of the gang’s operations had hinted about the idea on 19 March, saying that they were looking to return the payments to those who had paid ransoms. Making payments to ransomware groups in an attempt to recover encrypted or stolen data is generally not advised and might even lead to prosecution.

However, according to statements seen by BleepingComputer, the group announced their retirement from cyber crime on 6 February, with the administrator of the operation expressing regret about their actions and announcing that they had “decided to publish all decryption keys” to the affected systems.

The next day, they shared a SQL file containing 922 decryption keys which could be used by their victims to regain access to their data. The Ziggy administrator also provided the victims with a decryption tool, as well as the source code for a decryptor that doesn’t require access to an internet network.

Related Resource

Managing security risk and compliance in a challenging landscape

How key technology partners grow with your organisation

How to manage security risk and compliance - whitepaperDownload now

Almost two months later, the Ziggy group is now also offering to return the ransom payments, with victims asked to contact the gang’s admin at ziggyransomware@secmail.pro and attach proof of payment as well as their computer ID. According to the hackers, the money will be returned to the victim’s Bitcoin wallet within two weeks.

However, it's worth noting that currently there is little evidence to suggest that the money will in fact be returned.

Despite offering to return the paid ransoms, the Ziggy group will still be profiting from the cyber attacks due to the payments being made in Bitcoin. It appears that hackers will return only the value of the ransom at the time of payment, rather than the quantity of bitcoin paid - a cryptocurrency that has surged in value in recent months.

On 7 February, when the decryption keys were made public, the price of one Bitcoin was around £28,000. At the time of writing, it is valued at over £41,000.

Featured Resources

B2B under quarantine

Key B2C e-commerce features B2B need to adopt to survive

Download now

The top three IT pains of the new reality and how to solve them

Driving more resiliency with unified operations and service management

Download now

The five essentials from your endpoint security partner

Empower your MSP business to operate efficiently

Download now

How fashion retailers are redesigning their digital future

Fashion retail guide

Download now

Recommended

New ransomware group is attacking US firms and educational establishments
ransomware

New ransomware group is attacking US firms and educational establishments

15 Jul 2021
Interpol calls for more action to prevent "ransomware pandemic"
cyber security

Interpol calls for more action to prevent "ransomware pandemic"

13 Jul 2021
84% of organizations experienced phishing or ransomware attacks in the last year
ransomware

84% of organizations experienced phishing or ransomware attacks in the last year

12 Jul 2021
Best ransomware removal tools
ransomware

Best ransomware removal tools

9 Jul 2021

Most Popular

The benefits of workload optimisation
Sponsored

The benefits of workload optimisation

16 Jul 2021
Samsung Galaxy S21 5G review: A rose-tinted experience
Mobile Phones

Samsung Galaxy S21 5G review: A rose-tinted experience

14 Jul 2021
Six ways boards can step up support for cyber security
Business strategy

Six ways boards can step up support for cyber security

22 Jul 2021