EDA2

EDA2 is a Windows ransomware.

Background

EDA2 is the successor to HiddenTear. Like HiddenTear, it was created as an open-source project by a security researcher and released on Github. Intended as "educational ransomware," it deliberately contained encryption weaknesses that permit recovery of the encrypted files.

This plan backfired once threat actors started altering the HiddenTear and EDA2 source code. Some of their changes introduced bugs that destroyed encrypted files, while others corrected the encryption flaws and rendered key-less decryption impossible.

Source: Malpedia (Fraunhofer FKIE).