The prolific Ziggy ransomware gang has announced that it will start refunding ransom payments to its victims, following the group’s decision to cease operations.
The administrator of the gang’s operations had hinted about the idea on 19 March, saying that they were looking to return the payments to those who had paid ransoms. Making payments to ransomware groups in an attempt to recover encrypted or stolen data is generally not advised and might even lead to prosecution.
However, according to statements seen by BleepingComputer, the group announced their retirement from cyber crime on 6 February, with the administrator of the operation expressing regret about their actions and announcing that they had “decided to publish all decryption keys” to the affected systems.
The next day, they shared a SQL file containing 922 decryption keys which could be used by their victims to regain access to their data. The Ziggy administrator also provided the victims with a decryption tool, as well as the source code for a decryptor that doesn’t require access to an internet network.
RELATED RESOURCE
Managing security risk and compliance in a challenging landscape
How key technology partners grow with your organisation
Almost two months later, the Ziggy group is now also offering to return the ransom payments, with victims asked to contact the gang’s admin at ziggyransomware@secmail.pro and attach proof of payment as well as their computer ID. According to the hackers, the money will be returned to the victim’s Bitcoin wallet within two weeks.
However, it's worth noting that currently there is little evidence to suggest that the money will in fact be returned.
Despite offering to return the paid ransoms, the Ziggy group will still be profiting from the cyber attacks due to the payments being made in Bitcoin. It appears that hackers will return only the value of the ransom at the time of payment, rather than the quantity of bitcoin paid - a cryptocurrency that has surged in value in recent months.
On 7 February, when the decryption keys were made public, the price of one Bitcoin was around £28,000. At the time of writing, it is valued at over £41,000.
-
Bigger salaries, more burnout: Is the CISO role in crisis?In-depth CISOs are more stressed than ever before – but why is this and what can be done?
-
Cheap cyber crime kits can be bought on the dark web for less than $25News Research from NordVPN shows phishing kits are now widely available on the dark web and via messaging apps like Telegram, and are often selling for less than $25.
-
‘Phishing kits are a force multiplier': Cheap cyber crime kits can be bought on the dark web for less than $25 – and experts warn it’s lowering the barrier of entry for amateur hackers
News Research from NordVPN shows phishing kits are now widely available on the dark web and via messaging apps like Telegram, and are often selling for less than $25.
-
Healthcare systems are rife with exploits — and ransomware gangs have noticedNews Nearly nine-in-ten healthcare organizations have medical devices that are vulnerable to exploits, and ransomware groups are taking notice.
-
Alleged LockBit developer extradited to the USNews A Russian-Israeli man has been extradited to the US amid accusations of being a key LockBit ransomware developer.
-
February was the worst month on record for ransomware attacks – and one threat group had a field dayNews February 2025 was the worst month on record for the number of ransomware attacks, according to new research from Bitdefender.
-
CISA issues warning over Medusa ransomware after 300 victims from critical sectors impactedNews The Medusa ransomware as a Service operation compromised twice as many organizations at the start of 2025 compared to 2024
-
Warning issued over prolific 'Ghost' ransomware groupNews The Ghost ransomware group is known to act fast and exploit vulnerabilities in public-facing appliances
-
The Zservers takedown is another big win for law enforcementNews LockBit has been dealt another blow by law enforcement after Dutch police took 127 of its servers offline
-
There’s a new ransomware player on the scene: the ‘BlackLock’ group has become one of the most prolific operators in the cyber crime industry – and researchers warn it’s only going to get worse for potential victimsNews Security experts have warned the BlackLock group could become the most active ransomware operator in 2025
