A lesser-known ransomware strain called AstraLocker has abruptly ended its operations, and the developer went a step further than most by handing over the keys to its victims. The developer submitted decryption tools to VirusTotal and told security researchers they are pivoting to cryptojacking instead. Cybersecurity firm Emsisoft has now packaged those keys into a free decryptor anyone can download.
The case raises familiar questions about why threat actors sometimes walk away, and what their departures actually mean for the people they targeted.
AstraLocker's Unusual Exit
The AstraLocker developer contacted Bleeping Computer directly to announce the shutdown with an oddly casual message: "It was fun, and fun things always end sometime. I'm closing the operation, decryptors are in zip files, clean." Another message read: "I'm done with ransomware for now. I'm going in cryptojacking lol."
Bleeping Computer verified the ZIP archive submitted to VirusTotal and confirmed at least one decryptor works against files encrypted in a recent campaign. Emsisoft later released a polished free decryptor covering the Babuk-based AstraLocker variant using the .Astra or .babyk file extension. The company warned users to remove the active malware first—otherwise the decryptor would simply re-encrypt files. If the initial infection came through Windows Remote Desktop, Emsisoft recommended changing all remote login passwords and checking for unauthorized accounts added by the attacker.
How AstraLocker Worked
AstraLocker used a delivery method that set it apart from many ransomware strains. Rather than first compromising a network or purchasing initial access from other hackers, the operator sent malicious Microsoft Word documents by email. Opening the document and clicking "Run" in a dialog prompt triggered an embedded OLE object that deployed the ransomware payload.
Before locking files, the malware checked whether it was running inside a virtual machine commonly used by security researchers for analysis. If it detected a VM, the ransomware shut itself down to avoid detection. It also terminated backup services and security software that could interfere with encryption.
Threat intelligence analysts found AstraLocker based on the leaked source code of Babuk Locker. One wallet address found in AstraLocker's ransom note also connected to Chaos ransomware operators, suggesting possible code sharing between the two groups.
Why Now?
AstraLocker remained relatively obscure until the developer released version 2.0, which drew fresh coverage from security blogs and likely drew law enforcement attention. The developer did not explicitly cite pressure from authorities, but the timing suggests increased scrutiny played a role.
Ransomware shutdowns are not unprecedented. Groups including Avaddon, Ragnarok, TeslaCrypt, and Shade have similarly released decryption keys before disbanding. Such gestures, while rare, do occur.
Why This Matters
Two things stand out. First, the developer released functional decryption keys without demanding payment. That is genuinely good news for victims who still had encrypted files. Emsisoft's free tool makes recovery straightforward for anyone with an affected system.
Second, the shift to cryptojacking is not a retreat from cybercrime—it is a redirection. Cryptojacking uses victim machines to mine cryptocurrency covertly. It is less disruptive than ransomware and harder to detect, making it a pragmatic career move for someone facing mounting heat.
The incident also illustrates a broader pattern: ransomware operators who attract media coverage tend to disappear faster than those who stay quiet. For defenders, that suggests high-profile campaigns carry implicit risks.
—
Who Should Care
| Audience | Why It Matters |
|---|---|
| Current AstraLocker victims | Free decryption tools are available from Emsisoft. Quarantine malware first, then recover files without paying. |
| IT administrators | Email-based Word document payloads remain a live threat. Scan attachments, disable macros by default, and monitor for unusual RDP activity. |
| Security teams | The developer pivoted rather than disappeared. Expect similar tactics under a new name. Low-profile operations persist longer. |
| General users | The same delivery method targets anyone who opens unexpected attachments. When in doubt, don't run. |
—
Key takeaways
- AstraLocker victims can recover files for free using Emsisoft's decryptor, but must remove active malware first.
- The developer's pivot to cryptojacking means the underlying intent to profit from compromised systems has not changed.
- Ransomware groups can disappear quickly, especially after attracting public attention.
- Email-based malware delivery through Word documents remains a live threat vector requiring ongoing vigilance.
Frequently asked questions
What happened to AstraLocker ransomware?
Its developer announced a shutdown, submitted working decryption keys to VirusTotal, and told researchers they are switching to cryptojacking.
Can AstraLocker victims recover their files without paying?
Yes. Emsisoft released a free decryptor covering the Babuk-based AstraLocker variant. Victims should quarantine the malware before running the tool.
Is AstraLocker gone for good?
The developer said they are done with ransomware "for now." The infrastructure is shut down, but the same individual may resurface under a new name.
How did AstraLocker infect computers?
It spread through malicious Word documents sent as email attachments. Opening the file and clicking "Run" deployed the payload without requiring other system compromise.
What is the difference between ransomware and cryptojacking?
Ransomware encrypts files and demands payment for decryption. Cryptojacking silently uses the victim's computer processing power to mine cryptocurrency for the attacker. Cryptojacking is less disruptive and easier to conceal.