Free Decryptor Released for AI-Powered FunkSec Ransomware

Researchers at Avast have unveiled a free decryptor tool for victims of the FunkSec ransomware, marking a significant step in combating this now-defunct malware strain.

Developed in collaboration with law-enforcement agencies, the decryptor enables affected users to recover encrypted files without paying ransoms.

With the ransomware operation deemed inactive, Avast has made the tool publicly available, targeting the 113 documented victims listed on the gang’s leak site.

Overview of the Ransomware Threat

The timeline of FunkSec’s activities reveals a progression from data exfiltration and extortion starting on December 4, 2024, to the upload of initial source code on VirusTotal by December 15, 2024, and the first known ransomware sample appearing on December 31, 2024.

Operations peaked with the latest victim reported on March 15, 2025, after which the group ceased activity.

Notably, FunkSec incorporated artificial intelligence in about 20% of its operations, leveraging AI to generate tools and ...