Avast Releases Decryptor for AI-Assisted FunkSec Ransomware
FunkSec, an AI-assisted ransomware active from December 2024 to early 2025, reportedly affected 113 victims using AI to refine phishing and encrypt data with the Chacha20 algorithm. Avast and law enforcement released a free decryptor after the threat actor's activity ceased.
What happened
FunkSec ransomware, described as AI-powered and written in Rust, first surfaced in December 2024 and combined data exfiltration with file encryption for extortion. The group leveraged AI to refine phishing templates and create tools, accounting for approximately 20% of its operations.
Gen Digital counted 113 victims during the ransomware's operational lifespan. The threat actor activity ceased earlier in 2025, with the latest breach claim reported in March involving UNIMORE University's systems.
Reported impact
FunkSec encrypted large volumes of data and applied the '.funksec' extension to encrypted files, with customized ransom notes titled 'README-{random}.md.'
Index analysis
The ransomware used the Chacha20 encryption algorithm with Poly1305 MAC. Avast collaborated with law enforcement to develop and release a free public decryptor tool supporting both 64-bit and 32-bit systems.
Governance controls
The decryptor was released for public download because the ransomware is now considered dead, according to a Gen Digital report.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.