Avaddon ransomware gang releases decryption keys for 2,934 of its victims and is likely shutting down due to increased scrutiny by governments around the world
The Avaddon ransomware gang has shut down operation and released the decryption keys for their victims to BleepingComputer.com.
Context & Ripple Effects
Avaddon's exit follows a playbook the ecosystem has seen before: when the developers of TeslaCrypt shut down in 2016 they also released a master key so victims could decrypt for free. What has changed since is the stated cause — Avaddon attributes its shutdown to increased scrutiny by governments worldwide, not internal factors.
The shutdown lands mid-escalation on that front: months later BlackMatter would announce its own closure citing 'pressure from the authorities', and Conti would pull infrastructure offline while its leaders regrouped under other brands. Avaddon had also already imposed rules barring affiliates from hitting government, healthcare, education and charity targets — a sign the brand was managing political heat before abandoning it.
First-order effects
- The 2,933 other victims alongside BleepingComputer's readers can now recover files for free instead of negotiating ransoms — the immediate value flows to victims who never paid or are still deciding.
Second-order effects
- Affiliates renting Avaddon's malware must migrate to rival brands, following the pattern AdvIntel described when Conti went dark and its leaders partnered with smaller groups — demand for ransomware-as-a-service capacity doesn't disappear, it relocates.
Third-order effects
- If government pressure keeps forcing brand shutdowns, the industry structure shifts toward disposable brands that rebrand rather than retire, with law-enforcement seizures like the LockBit key recovery becoming a recurring cleanup mechanism after each exit.
The trend: Ransomware operations are entering a cycle where sustained government pressure forces brands to shut down and rebrand, leaving victims with free decryption and affiliates shopping for new platforms.