Loading story…
The operators behind SynAck ransomware, later rebranded as El_Cometa, released master decryption keys for victims infected from July 2017 through early 2021, allowing recovery of files from older attacks. A person claiming to be a former SynAck member provided the keys to The Record, and malware analyst Michael Gillespie of Emsisoft verified them by successfully decrypting data from prior incidents. Emsisoft said it would publish a safer public decryptor rather than have victims rely directly on leaked materials, and later released a SynAck decryption tool.
SynAck had been known as a targeted ransomware operation that used advanced evasion methods, including Process Doppelgänging, heavy obfuscation, dynamic API resolution, sandbox checks, and country-based filtering to avoid analysis and detection. Researchers previously reported that the malware encrypted files with AES-256 while using an ECIES-like key protection scheme, terminated processes and backup-related services such as VSS, and cleared Windows event logs to hinder recovery and investigation. The gang said it disclosed the old keys after winding down the original SynAck operation and shifting to a broader ransomware-as-a-service model under the El_Cometa name.
TTPs, infrastructure, and targeting history in one profile.
8 events from the most recent confirmed update back to the earliest known activity.
Kaspersky analyzed a SynAck ransomware sample observed in April 2018 that used Process Doppelgänging and other anti-analysis features to evade security tools.
The Process Doppelgänging technique later used by SynAck was first presented publicly at Black Hat in December 2017.
Kaspersky reported that SynAck ransomware had been known since at least September 2017, establishing an early documented timeframe for the threat's activity.
The Record says SynAck was first spotted in July 2017, marking the earliest identified appearance of the ransomware family.
The Record states that Emsisoft later published a public SynAck decrypter to help victims recover files more safely than using the leaked materials directly.
Malware analyst Michael Gillespie of Emsisoft verified the leaked SynAck keys as authentic and successfully decrypted files from prior SynAck incidents.
A person claiming to be a former SynAck member provided The Record with master decryption keys covering victims infected between July 2017 and early 2021.
According to The Record, the group said it launched a new ransomware operation called El_Cometa the previous month after winding down the old SynAck operation.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Avaddon emerged as a **ransomware-as-a-service** operation that initially spread through a massive phishing campaign using smiley-themed lures such as “Your new photo?” and JavaScript attachments disguised as images. The malware downloaded its payload with PowerShell and `BITSAdmin`, encrypted files with the `.avdn` extension, dropped HTML ransom notes, changed desktop wallpaper, and directed victims to Tor-based payment pages. Researchers and vendors linked early distribution to large botnet-driven spam activity and later observed affiliates using additional access methods including exposed **RDP**, weak **VPN** credentials, and network vulnerability exploitation. As the operation matured, Avaddon expanded into multi-extortion, publicly listing victims on a leak site, releasing stolen data, and in some cases adding **DDoS** pressure while continuously updating its code to evade detection and defeat public decryptors. Reports described anti-analysis features, persistence via scheduled tasks and Run registry keys, deletion of backups and shadow copies, and regional exclusions that avoided CIS-language systems. After becoming one of the most active ransomware threats and drawing warnings from authorities, the group abruptly shut down and released **2,934 decryption keys**, which were validated by incident-response firms and used to build a free decryptor for victims.
Aug 15, 2026
Avast released a free decryptor for **TargetCompany ransomware**, also tracked as **Mallox**, allowing some victims to recover encrypted files without paying. The tool works by cracking the decryption password from a pair of matching encrypted and original files, a CPU-intensive process that can take **tens of hours** but only needs to be completed once per affected device; interrupted cracking sessions can also be resumed. Researchers said the ransomware has been active since mid-2021, commonly appending extensions including `.mallox`, `.exploit`, `.architek`, and `.brg`, and dropping the ransom note **`HOW TO RECOVER !!.TXT`** in affected folders. Technical reporting shows the malware prepares systems for encryption by deleting **shadow copies**, altering boot and recovery settings, assigning privileges, enumerating drives, and terminating processes that could lock valuable data such as databases and backup-related services. Avast said file encryption uses **ChaCha20**, with key protection involving **Curve25519** and **AES-128**, while later threat intelligence linked Mallox to a more active double-extortion operation that uses a .NET loader, in-memory payload decryption, victim data exfiltration, and a leak site, with some observed process-killing behavior suggesting possible interest in critical infrastructure and operational technology environments.
Aug 15, 2026
Master decryption keys for the **Maze**, **Egregor**, and **Sekhmet** ransomware families were publicly leaked on the BleepingComputer forums by a user calling themselves **"Topleak,"** who claimed to be the developer behind all three operations. The leak reportedly included multiple `RSA-2048` master keys associated with affiliates, and one report said it also contained source code for the **M0yv** malware used by the Maze operation. The poster said the release was intentional and not the result of recent law-enforcement arrests or infrastructure seizures. Researchers **Michael Gillespie** and **Fabian Wosar** reviewed the material and confirmed the keys were legitimate, allowing recovery of files encrypted by the three ransomware strains. **Emsisoft** then released a free decryptor for victims of Maze, Egregor, and Sekhmet. The disclosures also reinforced the close relationship among the families, with reporting noting Maze’s evolution into Egregor and code similarities linking Egregor, Sekhmet, and Maze.
Aug 15, 2026