Menu
TeslaCrypt victims can now decrypt their files for free

TeslaCrypt victims can now decrypt their files for free

Security shocker: Ransomware creators give researchers the master decryption key

Victims of the widespread TeslaCrypt ransomware are in luck: Security researchers have created a tool that can decrypt files affected by recent versions of the malicious program.

Surprisingly, the TeslaCrypt creators themselves helped the researchers.

TeslaCrypt first appeared in early 2015 and stood out by targeting game-related user content, such as save files and custom maps, in addition to personal documents and pictures -- 185 different file extensions in total.

The program had some moderate success in the beginning, earning its creators $76,522 in less than two months. However, in April 2015, researchers from Cisco Systems discovered a flaw in the ransomware program that allowed them to create a decryption tool for some of its variants.

The number of TeslaCrypt attacks spiked in December and starting with version 3.0.1 of the program, which appeared in March, all encryption flaws were fixed and the existing decryption tools were rendered ineffective. That lasted until Wednesday.

Researchers from security vendor ESET have recently managed to obtain a copy of TeslaCrypt's master key, allowing them to create a new decryption tool that is capable of recovering files affected by the newer versions of TeslaCrypt (3.0 and higher). They didn't do this by exploiting a vulnerability in the program or its command-and-control servers, but by asking its creators for it.

"Recently, TeslaCrypt’s operators announced that they are wrapping up their malevolent activities," the ESET researchers said in a blog post. "On this occasion, one of ESET’s analysts contacted the group anonymously, using the official support channel offered to the ransomware victims by the TeslaCrypt’s operators, and requested the universal master decryption key. Surprisingly, they made it public."

The tool can recover TeslaCrypt-encrypted files whose extension was changed to .xxx, .ttt, .micro and .mp3, as well as those whose extension hasn't been modified. Instructions on downloading and using the tool can be found on ESET's support website.

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Slideshows

Top 50 defining moments of the New Zealand channel in 2016

Top 50 defining moments of the New Zealand channel in 2016

Reseller News looks back on a tumultuous 12 months for the New Zealand channel, assessing the fallout from a year of sizeable industry change. Whether it be local or global mergers and acquisitions, distribution deals or job changes, the channel that started the year differs somewhat to the one set to finish it - Reseller News assesses the key moments that made 2016.​

Top 50 defining moments of the New Zealand channel in 2016
​Hewlett Packard Enterprise honours high achieving NZ channel

​Hewlett Packard Enterprise honours high achieving NZ channel

Hewlett Packard Enterprise honoured its top performing Kiwi partners at the second running of its HPE Partner Awards in New Zealand, held at a glitzy ceremony in Auckland. Recognising excellence across eight categories - from distributors to resellers - the tech giant celebrated its first year as a standalone company, following its official split from HP in 2015.

​Hewlett Packard Enterprise honours high achieving NZ channel
Nutanix treats channel partners to Christmas cruise

Nutanix treats channel partners to Christmas cruise

Nutanix recently took to the seas for a Christmas Cruise around Sydney Harbour with its Australia and New Zealand staff, customers and partners to celebrate a stellar year for the vendor. With the sun out, they were all smiles and mingled over drinks and food.

Nutanix treats channel partners to Christmas cruise
Show Comments