Free Rhysida ransomware recovery tool published

Some smart folks have found a way to automatically unscramble documents encrypted by the Rhysida ransomware, and used that know-how to produce and release a handy recovery tool for victims. Rhysida is a newish ransomware gang that has been around since May last year. The extortion crew targets organizations in education, healthcare, manufacturing, information technology, and government; the crooks' most high-profile attack to date has been against the British Library. The gang is thought to be linked to the Vice Society criminal group, and it's known to lease out malware and infrastructure to affiliates for a cut of the proceeds. In research [PDF] published February 9, South Korea's Giyoon Kim, Soojin Kang, Seungjun Baek, Kimoon Kim, and Jongsung Kim explained how they uncovered an "implementation vulnerability" in the random number generator used by Rhysida to lock up victims' data. This flaw "enabled us to regenerate the internal state of the random number generator at the time of infection," and then decrypt the data, "using the regenerated random number generator," the team wrote. The Korea Internet and Security Agency (KISA) is now distributing the free Rhysida ransomware recovery tool which is the first successful decryptor of this particular strain of ransomware. "We aspire for our work to contribute to mitigating the damage inflicted by the Rhysida ransomware," the boffins, based variously at Kookmin University and KISA, noted in their paper. Rhysida ransomware uses L...