Tesla Crypt 3.0.1 - Tales From The Crypt(o)!
Summary: Cisco Talos reverse engineered TeslaCrypt 3.0.1, the latest variant of a ransomware family it ranks in the top 5 it sees most often, and found the authors replaced the earlier key-storage weakness with elliptic curve cryptography on secp256k1. The new scheme generates global and per-session keys, encrypts the victim's global private key with AES-256 using a SHA256 of a shared secret derived from the attackers' command-and-control public key, and stores recovery data redundantly in the registry and in each encrypted file's header. Talos states it is not aware of any tool that can decrypt files encrypted by this variant, unlike the previous release.
What's compelling: The decryption path runs through a private key held only by the adversaries and never stored on the victim's machine, so recovery depends entirely on the attackers - and Talos names no available decryptor for this variant.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026