Rhysida Ransomware Decrypted

FanJ · Feb 14, 2024

Avast Threat Research Team - February 13, 2024
https://decoded.avast.io/threatresearch/decrypted-rhysida-ransomware/

In October 2023, we published a blog post containing technical analysis of the Rhysida ransomware. What we intentionally omitted in the blog post was that we had been aware of a cryptographic vulnerability in this ransomware for several months and, since August 2023, we had covertly provided victims with our decryption tool. Thanks to our collaboration with law enforcement units, we were able to quietly assist numerous organizations by decrypting their files for free, enabling them to regain functionality. Given the weakness in Rhysida ransomware was publicly disclosed recently, we are now publicly releasing our decryptor for download to all victims of the Rhysida ransomware.
Click to expand...

The Rhysida ransomware has been active since May 2023. As of Feb 2024, their TOR site lists 78 attacked companies, including IT (Information Technology) sector, healthcare, universities, and government organizations.
Click to expand...

Usage of the Decryptor

Please, read the following instructions carefully. The rate of success depends on them.
Click to expand...

Read there more!

FanJ · Feb 14, 2024

PS:
At the moment I don't know whether the Avast Rhysida Decryption Tool is also available at the NoMoreRansom site.
https://www.nomoreransom.org/en/decryption-tools.html
I cannot find it there, but maybe I didn't look good enough; that could very well be.

Log in or Sign up

Rhysida Ransomware Decrypted

FanJ Updates Team

FanJ Updates Team

Log in or Sign up

Rhysida Ransomware Decrypted

FanJ Updates Team

FanJ Updates Team

Useful Searches