Staff member
The operators behind the Shade Ransomware (Troldesh) have shut down their operations, released over 750,000 decryption keys, and apologized for the harm they caused their victims.

The Shade Ransomware has been in operation since around 2014. Unlike other ransomware families that specifically avoid encrypting victims in Russia and other CIS countries, Shade targets people in Russia and Ukraine predominantly.

According to Michael Gillespie, the creator of the ransomware identification site ID Ransomware, submission related to the Shade Ransomware has been steady over the years until the end of 2019 when it started to dwindle.

Facts in a nutshell:
  • Keys and decrypter released here:
  • The decrypter is not user friendly. So Kaspersky will be updating its RakhniDecryptor with the keys.


Staff member
Malware Hunter
We are the team which created a trojan-encryptor mostly known as Shade, Troldesh or Encoder.858. In fact, we stopped its distribution in the end of 2019. Now we made a decision to put the last point in this story and to publish all the decryption keys we have (over 750 thousands at all). We are also publishing our decryption soft; we also hope that, having the keys, antivirus companies will issue their own more user-friendly decryption tools. All other data related to our activity (including the source codes of the trojan) was irrevocably destroyed. We apologize to all the victims of the trojan and hope that the keys we published will help them to recover their data.
Note: Some of the published software is detected by some antiviruses because it uses common code blocks with the encryptor. To avoid the deletion of them all the exe files were zipped with the same password: 123454321
Full source :


Level 38
Content Creator


Level 22


Level 6
I hope all are well and safe.

Further to the positive news of Shade Ransomware shuts down, releases 750K decryption keys:

Bitdefender and Kaspersky released their decryption tools to assist victims:



I hope this will be useful to everyone>