Irish health service offered free key by criminals

In an unprecedented move, the ransomware gang who targeted Ireland’s health service offered a decryption key that they said could be used to unlock computers infected with their ransomware.  The group, WIZARD SPIDER, is an established, high-profile and sophisticated eCrime group, originally known for the creation and operation of the TrickBot banking malware. This Russia-based eCrime group originally began deploying TrickBot for the purpose of conducting financial fraud in 2016, but has since evolved into a highly capable group with a diverse and potent arsenal, including Ryuk, Conti and BazarLoader

While seeming to offer an olive branch, the group reiterated its threats to disclose patient data unless Irish authorities paid the $20 million ransom demand.

“We are providing the decryption tool for your network for free,” the hackers said in the message posted on Thursday, which was reviewed by Bloomberg News. “But you should understand that we will sell or publish a lot of private data if you will not connect us and try to resolve the situation.”