Cybersecurity researchers have delivered welcome news for victims of the FunkSec ransomware: a free decryption tool is now available to recover locked files.
## The End of FunkSec
Gen Digital researcher Ladislav Zezula announced the release, stating, “Because the ransomware is now considered dead, we released the decryptor for public download.” The ransomware group appears to have ceased operations, with no new victims added to their data leak site since March 18, 2025.
## Attack Statistics and Targets
FunkSec, which emerged in late 2024, successfully compromised 172 organizations according to Ransomware.live data. The attacks primarily targeted:
– **Geographic regions**: United States, India, and Brazil
– **Key sectors**: Technology companies, government agencies, and educational institutions
## Technical Analysis
Security experts from Check Point discovered that FunkSec’s development showed signs of artificial intelligence assistance, suggesting the group consisted of inexperienced hackers seeking recognition through high-profile attacks.
The ransomware was built using Rust, a programming language increasingly popular among cybercriminal groups for its speed and stealth capabilities. Other notorious ransomware families like BlackCat and Agenda also leverage Rust for similar advantages.
**Encryption Details:**
– Uses orion-rs library (version 0.17.7)
– Employs Chacha20 and Poly1305 algorithms
– Encrypts files in 128-byte blocks
– Adds 48 bytes of metadata per block, making encrypted files approximately 37% larger
## How to Use the Decryptor
Victims can access the free decryption tool through the No More Ransom project. Before attempting recovery:
1. **Verify infection**: Confirm files have the .funksec extension or unique metadata padding
2. **Create backups**: Save copies of encrypted files to prevent data loss
3. **Follow instructions**: Use the step-by-step guide provided on the No More Ransom portal
While Gen Digital hasn’t revealed how they developed the decryptor or whether it exploits a cryptographic weakness, the tool offers hope for organizations still struggling with FunkSec-encrypted data.
This development highlights the cybersecurity community’s ongoing efforts to combat ransomware and provide free recovery solutions for victims worldwide.