El_Cometa is the ransomware-as-a-service operation the SynAck group started in July 2021 after winding SynAck down, planning to recruit many more affiliates than the two partners that had spread the older strain. When it retired SynAck in August 2021 the group handed out master keys, and Emsisoft built a free decryptor from them, but those keys cover SynAck infections from July 2017 to early 2021 and nothing published shows them unlocking El_Cometa files. Its extension and note format have not been documented, so compare the note and renamed files against the SynAck page before choosing a recovery route, isolate affected machines and keep encrypted samples.
Sources: The Record, Security Affairs, No More Ransom
Decryptor: Decryptor availability has not been recorded. Checked 2026-10-30.
Dealing with an active incident? Our incident response team is available 24/7.
Emergency response: +1 (877) 364-5161