Decrypting the Lock Crypt Ransomware
Summary: Unit 42 analyzed LockCrypt (also known as EncryptServer2018), a ransomware family active since mid-2017 that uses custom, home-made encryption rather than standard Windows APIs. The researchers broke that encryption and recovered the original key by building a sparse 200000x200000 matrix over GF(2) and solving it with SageMath, requiring at least 25KB of known plaintext.
What you should know: LockCrypt's weak custom cipher let researchers recover the key from 25KB of known plaintext - files like DLLs that can be re-obtained by installing the same software version elsewhere - but a newer variant with stronger encryption has already been spotted and was not analyzed.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026