EDA2
- First seen
- 2015-08-25 00:00:00
- Malware type
- ransomware
- Family
- Malware family
- Profile updated
- 2026-07-07 14:43:15
Context
EDA2 is a successor of HiddenTear. Just like HiddenTear it was developed as an open-source project by a security researcher and published on Github. It was meant as "educational ransomware" and purposefully had flaws in the encryption process that allow decryption of ransomed files. This backfired, when threat actors began to modify HiddenTear and EDA2 source code. Some modifications introduced bugs where encrypted files were destroyed, others fixed the encryption flaws and made decryption without a key impossible.
Related threat objects
- HiddenTear (malware)
Reports & references
- Palo Alto Unit 42 — Covid 19 Themed Cyber Attacks Target Government And Medical Organizations (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Eda2 Ransom (report)
- twitter.com — 815861135882780673 (report)
- github.com — Eda2 (report)
- bleepingcomputer.com — Hidden Tear Ransomware Developer Blackmailed By Malware Developers Using His Code (report)
- utkusen.com — Im Sorry For Hidden Tear Eda2 (report)