Files Cannot Be Decrypted? Challenge Accepted. Talos Releases Thanatos Decryptor
Summary: Cisco Talos released ThanatosDecryptor, a free tool that exploits weaknesses in the Thanatos ransomware's encryption design, which derives each file's AES-256 key from system uptime via GetTickCount and then discards it, so the authors cannot decrypt data even if a ransom is paid. Talos found the same hardcoded bitcoin wallet across samples, that wallet was not even valid, and across all samples the attacker's wallets had received only about $720 USD total.
What you should know: Thanatos discarded its own encryption keys, so paying the ransom could never have returned the data, and one campaign delivered via a Discord attachment posing as a Minecraft mod stated outright that decryption was not available, meaning the goal was destroying data rather than profit.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026