Threat Spotlight: Tesla Crypt - Decrypt It Yourself
Summary: Cisco Talos analyzed two TeslaCrypt ransomware samples, dated March and April 2015, and found the malware claims to use asymmetric RSA-2048 encryption but actually uses symmetric AES. Talos released a command-line decryption tool that recovers files using the victim's key.dat file, and noted TeslaCrypt targets over 170 file extensions including game saves and Steam activation keys.
Bottom line: The ransomware's own ransom note misstates its encryption, and Talos published a working decryptor plus the source code on GitHub - so victims who kept key.dat may recover files without paying, while those who lost it face the threat actor's TOR site and recovery key.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2015-0311
- Related
- CVE-2015-0311: Adobe Flash Player Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Apr 13, 2022Flash 0-day Exploited by Angler Exploit Kit Cyber Risks ·Angler Exploit Kit - New Variants Cyber Risks ·