Forest Global Training Partners

Cyber Risks · Cisco Talos

Pylocky Unlocked: Cisco Talos releases PyLocky ransomware decryptor

Summary: Cisco Talos released a free decryptor for PyLocky, a Python-written ransomware family that masquerades as a Locky variant, encrypts all files on a victim machine, and appends the extension ".lockedfile" to each one. The tool only works if the infected machine's initial PyLocky command-and-control traffic was captured, because that first callout sends the C2 server the base64-encoded initialization vector and system information the malware uses in encryption.

What you should know: The decryptor is useless without prior network monitoring of that first C2 callout, so recovery depends on whether traffic was captured before encryption began - and Talos notes it has repeatedly seen ransom-demanding attackers with no way to communicate a decryptor to victims at all.

Read the original at Cisco Talos ↗

Topics
Malware
Related