Each key decryptor likely represents one attack making Shade particularly virulent during its time. The group gave no reason for its sudden change of heart and Shahrokh Shahidzadeh, CEO at Acceptto, said the reasoning doesn’t matter.
“Net-net this is a great win for the good guys. No matter what the motives of the operators of the Shade (Troldesh) ransomware, we will take it,” he told SC Media. “While this might mean that they are out of the game for good, it’s not the first time that a group of attackers has torn down their infrastructure and gone dormant only to resurface later using different infrastructures and the same set of tools.”