The German Web developer from Meitingen, Bavaria, who fought Ransomware by hacking their control server and letting the crypto-keys of the Trojan go along. Since then, he has been actively seeking victims of the Trojan on Twitter and sending them links to the keys that help them save their data.
Uncertain Trojan Control Center
The German web developer fell victim to the Malware Muhstik, the network storage devices (NAS) of QNAP. After paying 670 euros to the blackmailers to retrieve his data, he analyzed the Trojan. He was able to draw conclusions on the command servers of criminals. Apparently the criminals had compromised third-party web servers and installed their Muhstik Trojan control software there.
Through an open Webshell, the German man managed to hijack the PHP script, which enters the data of new victims in a SQL database, he explains in an interview with the US news site Bleeping Computer. With his own PHP script he generated, based on this database, own keys to rescue the data of all 2,858 victims of the Trojan at that time. The German web developer has published the keys of the victims in a file on Pastebin. Victims of the Trojan can use them together with a decryption tool from security company Emsisoft to save their data.
Hacking is punishable
The web developer from Bavaria wrote in a forum post at Bleeping Computer, that he was aware that he had made a criminal offense. In his view, he has hacked only systems that were previously hacked by the criminals.
“I’m not the bad guy in this situation,” he explains in the forum post.
Nevertheless, it should be emphasized once again that the penetration into the computer systems of others is punishable, even if the target of the attack is criminals. Whether such an attack can be morally justified is another matter. In case of doubt, law enforcement authorities and courts are only interested in whether a criminal offense exists.
