Overview

• Gen Digital and Avast researchers collaborated with law enforcement to develop and publicly release a free decryptor for the FunkSec strain.
• The decryptor can be downloaded from the No More Ransom portal to restore files encrypted with the .funksec extension.
• FunkSec operators have not published any new victims since March 18, 2025, leading experts to classify the ransomware as inactive.
• Technical analysis shows FunkSec was written in Rust using the orion-rs library with ChaCha20 and Poly1305 encryption and featured AI-assisted code development.
• The group claimed 172 victims across the United States, India, and Brazil, targeting primarily technology, government, and education organizations.