A Tool To Unlock Ransomware

As many of you know, ransomware is a malware that infects Windows systems and encrypts files to make them inaccessible and unusable. At the time of the infection, the hacker demands payment in exchange for the decryption key. Even if the ransom is paid, the decryption key is not always received.

In a nice development, security software company Kaspersky has worked with the Dutch police’s National High Tech Crime Unit (NHTCU) to offer a free tool that decrypts files locked by ransomware known as CoinVault. The NHTCH discovered a Coin Vault server that contained a database of decryption keys. Kaspersky then worked with NHTCH to develop the tool that can unlock encrypted files and restore them for use. Unfortunately, the tool does not work in all cases as NHTCH did not find all of the CoinVault decryption keys. The ransomware decryptor, as well as a “How To” guide, can be found on the Kaspersky website at https://noransom.kaspersky.com/.

This news, however, must be tempered by the fact that hackers are always working on new strains of ransomware. Even when there is progress in fighting version 1.0, the bad guys are ready to strike with version 1.1. This brings us back to always practicing the basics of fighting ransomware… frequent data back-up and good computer security awareness.

By: Richard Sheinis, Esq.