Decrypted: Rhysida Ransomware

In October 2023, we published a blog post containing technical analysis of the Rhysida ransomware. What we intentionally omitted in the blog post was that we had been aware of a cryptographic vulnerability in this ransomware for several months and, since August 2023, we had covertly provided victims with our decryption tool. Thanks to our collaboration with law enforcement units, we were able to quietly assist numerous organizations by decrypting their files for free, enabling them to regain functionality. Given …

analysis august aware blog blog post collaboration cryptographic decryption decryption tool malware analysis october ransomware rhysida rhysida ransomware technical technical analysis thanks tool vulnerability