Article
Ransomware Decryptors for a (varying) fee
Arete Analysis
Ransomware attacks wreak havoc on business operations. Destroying recovery options, instilling fear and panic, and most often creating high levels of stress for IT staff, owners, and operators. A simple, but often costly fix is to just pay the Threat Actor for the decryption utility. While making a payment to an anonymous entity is a highly debated topic, let us assume, for the purposes of this article, that the payment is the only option other than closing your business. Please note, Arete is not advocating to pay ransoms; the choice is entirely a business decision to pursue. This article is intended to provide insight into the various types of decryptors the threat groups provide to unlock your files. We will discuss specific decryptors for some of the more popular variants as well as address subtle nuances between the decryptors.
Full Disk Encryption
Ransomware variants like THT, Mamba, or MCrypt use native or opensource encryption software to encrypt the entire hard drive of the system. Once the TA gains access to the system with administrator privileges, the TA will use a tool like Bestcrypt, DiskCryptor or even Windows Bitlocker to encrypt the full disk. Once encryption is complete, the system reboots and the victims are locked out.
Communication preference: Email usually protonmail, firemail.cc, or cock.li domains
Average ransom payment: $36,000 – $55,000
Preferred currency: Bitcoin (BTC)
Decryptor received: 100% of the time. TA will provide passwords per system for access
Watch out: MCrypt will hold volumes hostage and “re-extort” victims into making multiple payments. During the initial negotiation, the TA will not indicate multiple drives are encrypted. Instead they will negotiate a single amount for initial access to the Operating System; essentially allowing access into Windows. Once access to Windows is regained, victims often surprised to find their “data” partitions are encrypted causing the victim to return to the negotiation table to once again shell out more money to unlock their information.
Notes: After gaining access, the open source encryption tool still needs to be removed otherwise after reboot, the data storage will be locked again.
System Specific Encryption
Ransomware variants like Phobos, Dharma or CryLock are file level encryption. The TA gains access to the system, copies specific encryption executables onto the systems then runs the executables to encrypt the files. The results are files with a new extension appended to the old file name. Sometimes it’s a random sequence of numbers and letters (e.g. *.nocv) or a specific tag (e.g. *[CryLockDecrypt@****.com][1].[ID-*****- COM]). System specific encryption generates a unique key per encrypted system. The ransom note or the file extension may indicate an “ID” that would be different on each system.
CryLock Scanner & Decryptor
Communication preference: Email usually aol.com, protonmail.com, or cock.li domains
Average ransom payment: $27,000 – $500,000
Preferred currency: Bitcoin (BTC)
Decryptor Received: 95% of the time. Certain variants of Phobos and Dharma will attempt to re-extort a second payment if a large discount is negotiated.
Watch out: Phobos, Dharma, and CryLock are a two-step process. The TA will first send a “scanner” tool that needs to be run on every infected system. The scanner will look for the public keys used to encrypt the files, then write that information to a corresponding .txt or .ini file. Those corresponding files need to be sent to the TA in order to generate a decryptor. The TA in return will send the decryptors. The two-step process adds significant overhead due to the running of multiple tools on the infected system as well as the delay with communicating via email. On average after making a payment for the decryptor, clients are who are infected with Phobos are down for approximately 11 days whereas clients who are infected with Dharma experience downtime of about 7.75 days. The high number of days can be attributed to the two-step process and multiple email communications.
Notes: Negotiating with the Phobos and Dharma group can be tricky. These variants are Ransom-as-a-Service (RaaS) model so you’re not dealing with the same core group of people as you would with variants like Ryuk (or now Conti). Negotiating with RaaS groups can also create confusion and complexities with a different operator responding to each email. The groups who deploy these variants also look for exploiting publicly accessible Remote Desktop Protocol (RDP). Disable external access to RDP to lessen the chance of being infected by this variant.
System Specific Encryption with a Universal Option
Ransomware variants like Sodinokibi are file level encryption with a unique ID per system. Once the TA gains access to the network, they release their Sodinokibi ransomware throughout the environment. The systems are infected with a unique randomly generated file extension per system. Their ransom notes are usually within a text file and explain what happened, including if any data was exfiltrated. The group is very organized and can often share information about their victim’s networks including domain information, infected systems, and any stolen data.
Sodinokibi Decryptor
Communication preference: TOR Website via chat room. The ransom note contains a link to the TOR site as well as a unique key to gain access to a private chat room where the negotiations occur.
Average ransom payment: $170,000
Preferred currency: Monero (XMR)
Decryptor received: 100% of the time. Sodin offers a general decryptor which requires the victim to collect the file extensions from all of their infected systems. This can be very tedious once the payment is made, the victim can input any number of file extensions into the input box on the TOR site to generate a decryptor. Sodin will keep that private room open for 30 days after payment allowing victims to return if they find any extensions not previously found. A lesser known secret with Sodin, if you ask nicely for a universal decryptor, the operator may create the decryptor for you; providing a single decryptor that can be used across your network. The universal decryptor certainly saves a lot of time with decrypting files and minimizing the number of times having to launch the TOR browser.
Watch out: Earlier this year, Sodin changed their code base for their encryption payloads causing instability on certain Windows Operating Systems within the master boot files. Using certain security tools after a Sodin outbreak can cause systems to hang during reboot. Sodin encryption is one of the more aggressive encryptions.
Be sure to create a snapshot or backup the files prior to installing any new software or performing live forensics on critical systems.
Notes: Sodin has made headlines throughout 2020 for following Maze with exfiltrating data as well as being the first ransomware group to only accept Monero for payments.
System Specific Encryption with a Universal Option
Ransomware variants like Sodinokibi are file level encryption with a unique ID per system. Once the TA gains access to the network, they release their Sodinokibi ransomware throughout the environment. The systems are infected with a unique randomly generated file extension per system. Their ransom notes are usually within a text file and explain what happened, including if any data was exfiltrated. The group is very organized and can often share information about their victim’s networks including domain information, infected systems, and any stolen data.
Sodinokibi Decryptor
Communication preference: TOR Website via chat room. The ransom note contains a link to the TOR site as well as a unique key to gain access to a private chat room where the negotiations occur.
Average ransom payment: $170,000
Preferred currency: Monero (XMR)
Decryptor received: 100% of the time. Sodin offers a general decryptor which requires the victim to collect the file extensions from all of their infected systems. This can be very tedious once the payment is made, the victim can input any number of file extensions into the input box on the TOR site to generate a decryptor. Sodin will keep that private room open for 30 days after payment allowing victims to return if they find any extensions not previously found. A lesser known secret with Sodin, if you ask nicely for a universal decryptor, the operator may create the decryptor for you; providing a single decryptor that can be used across your network. The universal decryptor certainly saves a lot of time with decrypting files and minimizing the number of times having to launch the TOR browser.
Watch out: Earlier this year, Sodin changed their code base for their encryption payloads causing instability on certain Windows Operating Systems within the master boot files. Using certain security tools after a Sodin outbreak can cause systems to hang during reboot. Sodin encryption is one of the more aggressive encryptions.
Be sure to create a snapshot or backup the files prior to installing any new software or performing live forensics on critical systems.
Notes: Sodin has made headlines throughout 2020 for following Maze with exfiltrating data as well as being the first ransomware group to only accept Monero for payments. eir.co
Universal Encryption
Ransomware variants like Ryuk, WastedLocker, and Dopplepaymer are also file level encryption. These groups will gain access to the network and perform reconnaissance to identify the victim, understand their business, identify critical systems, and delete backups to force their victims into making a payment. The groups can have access to the network for a few hours or upwards of over a month. Ryuk is commonly associated with precursor trojans such as Trickbot and Emotet. Arete has observed Ryuk deployed as quickly as 6 hours after a Trickbot infection. Ryuk infections result with *.ryk appended to the file name. Comparatively, the deployment of WastedLocker is much more calculated with the TA staying on the network for an average of 2 weeks from initial infection to ransomware deployment. Wasted infections result with *.abcwasted appended to the file name where “abc” is a 3 letter abbreviation relating directly to the victims name.
WastedLocker Decryptor
Communication preference: Email usually protonmail.com domains or TOR Website
Average ransom payment: Ryuk $598,000; WastedLocker $2,400,000; Dopplepaymer $304,000
Preferred currency: Bitcoin (BTC)
Decryptor received: 100% of the time. The decryptor received is universal. It is typically a 32-bit executable that will work on any windows OS version. While these groups are known for a high ransom price, their decryptor is probably the simplest to run.
Watch out: WastedLocker is extremely difficult to negotiate. In fact, if negotiation is attempted, they may threaten to increase the ransom by approximately 5% of the ransom per day until it is paid. They are also very slow to respond to email and even post their business hours of UTC 5am- 8am and 5pm-8pm.
Notes: Dopplepaymer has been linked to gaining access to large environments and deploying cryptomining malware before launching their ransomware attack.
Pro Tips to Prevent Ransomware
Attacks
Implement Endpoint, Detection, and Response software such as SentinelOne to monitor the computer systems in use by your organization. SentinelOne uses Artificial Intelligence technology to detect malicious actions and prevent them before they can severely affect the endpoint.
Leverage a Security Operations Center (“SOC”) to monitor computer systems 24 hours a day by 7 days a week. The SOC can instantly respond to triage and mitigate any alerts while keeping your IT personnel focused on maintain business productivity.
Enable Multi-Factor Authentication (“MFA”) on remote access technologies such as VPN and Email.
Use complex passwords with a minimum of 16 alphanumeric characters (non- dictionary words).
Don’t reuse passwords.
Encourage discussion about cybersecurity within the workplace including establishing end user awareness training.
Ensure backups are current, air gapped from the production network, and viable.
Back to Blog Posts
Podcast
Cyber Campfire: June Threat Trends & Insights
In this episode of Arete’s Cyber Campfire podcast, our Threat Intelligence Team discusses trends, statistics, and emerging threat actors from June 2026. Tune in for firsthand insights on today’s threat landscape that can enhance your approach to cyber risk.
Article
Current: Misconfigured Server Reveals Multiple Phishing Campaigns
Researchers uncovered three Microsoft 365 phishing campaigns after discovering a misconfigured HTTP server that exposed a threat actor’s phishing tools, configurations, victim logs, and operational infrastructure. The investigation revealed two operators using custom Evilginx-based adversary-in-the-middle (AiTM) phishing frameworks to steal authentication sessions and bypass MFA protections. A third operator abused Microsoft’s OAuth Device Code flow by tricking victims into completing authentication through Microsoft’s legitimate login process, allowing attackers to obtain valid access and refresh tokens without stealing passwords. The largest campaign compromised at least 218 victims across 12 countries, primarily targeting corporate Microsoft 365 accounts, with refresh tokens enabling persistent access. Researchers also identified the use of remote management tools for maintaining access, AI-assisted development of phishing tooling, and links to broader Phishing-as-a-Service (PhaaS) ecosystems, highlighting how commodity frameworks and automation are lowering the barrier for sophisticated identity-based attacks.
What’s Notable and Unique
The campaigns demonstrate the continued shift from traditional credential theft to identity- and token-based compromise, in which attackers target authentication sessions, cookies, and OAuth tokens rather than relying solely on password theft. By obtaining valid authentication artifacts, attackers can access Microsoft 365 environments while bypassing conventional MFA protections.
The use of Evilginx-based AiTM frameworks highlights how publicly available phishing tools have evolved into effective MFA-bypass platforms. These frameworks proxy legitimate login pages, capture authenticated sessions, and allow attackers to reuse valid sessions without requiring victims’ credentials again.
The OAuth Device Code flow abuse represents a different attack method, in which attackers leverage a legitimate Microsoft authentication mechanism to obtain tokens after victims approve the request. This approach bypasses password theft entirely by abusing trusted authentication workflows.
The exposed infrastructure provided insight into attacker operations, including phishing configurations, victim tracking data, remote administration tools, and evidence of AI-assisted development. The findings demonstrate how phishing ecosystems now provide reusable tooling and automation that reduce the technical expertise required to conduct large-scale identity attacks.
Analyst Comments
These Microsoft 365 phishing campaigns demonstrate the ongoing evolution of identity-focused attacks, as adversaries increasingly target authentication sessions, tokens, and legitimate cloud authorization mechanisms to bypass traditional security controls. The combination of AiTM phishing, OAuth abuse, remote management tools, and PhaaS infrastructure enables threat actors to maintain persistent access while blending into legitimate cloud activity.
The growing availability of phishing frameworks and AI-assisted attack development highlights the need for continuous identity security improvements beyond traditional phishing defenses. Arete recommends that organizations strengthen identity monitoring, adopt phishing-resistant MFA where possible, review OAuth application permissions, monitor token activity, and implement conditional access policies to detect and restrict suspicious Microsoft 365 authentication behavior. Security teams should also monitor post-compromise indicators such as abnormal mailbox access, suspicious application consent, unauthorized remote tools, and unusual sign-in activity.
Sources
One Misconfigured Server, Three Active Campaigns: Full exposure of three AiTM Phishing Operators
Misconfigured Server Reveals Three Evilginx Phishing Operations Targeting Microsoft 365
Podcast
Digital Forensics Meets the Courtroom: Insights on Expert Witness and Cyber-Related Litigation
In this episode of Bytes of Insight, host Vinny Sakore and special guest Dr. Bruce Hartley, Managing Director and Co-Founder of Advisory Services at Arete, discuss the evolving role of digital forensics and expert witness work in cybersecurity litigation. Tune in for firsthand insights on how Arete conducts post-breach investigations, what it takes to undergo cross-examination on the stand, and how emerging threats like AI-driven social engineering and third-party breaches are reshaping the advisory landscape.
Article
Helix Extortion Group Debuts in SharePoint Data Theft Attacks
A newly identified data-extortion group, Helix, is reportedly conducting targeted campaigns by exploiting identity-based attack techniques to gain access to Microsoft 365 environments and exfiltrate data from SharePoint Online. The group leverages voice phishing (vishing), device code phishing, and multi-factor authentication (MFA) abuse to compromise user accounts and establish unauthorized access.
Helix threat actors reportedly initiate intrusions through vishing campaigns, impersonating trusted individuals—often the target's manager—and leveraging caller ID spoofing to enhance credibility.
The actors then attempt to persuade victims to complete device code phishing workflows, enabling unauthorized access to corporate accounts and Microsoft 365 resources.
Following successful authentication, the actors conduct reconnaissance and enumeration of SharePoint environments before identifying and exfiltrating sensitive data for extortion purposes.
Helix's variable dwell times suggest a flexible, target-specific operational approach, enabling the group to adapt its intrusion timeline to victim environments to maximize data theft and extortion opportunities while minimizing the likelihood of detection. Helix's operations also appear to be focused on large-scale data theft and extortion, with an emphasis on automated SharePoint data exfiltration following successful credential or session compromise.
Overlaps with Other Extortion Groups
Researchers assess that Helix likely emerged from or has operational overlap with the ShinyHunters and BlackFile/Redact cybercriminal ecosystems. ShinyHunters historically focuses on compromising websites, developer repositories, and exposed credentials or API keys to gain access to corporate cloud environments, monetizing stolen victim data on the dark web. BlackFile utilizes identity-centric and social engineering–driven methods of intrusion, relying less on traditional malware and instead leveraging credential theft, privilege escalation, rapid data exfiltration, and coercive tactics such as swatting to maximize extortion pressure. In May 2026, BlackFile announced that it would be rebranding as “Redact” (which may have later rebranded again to “Pink”), yet despite the rebrands, threat actors operating within these groups continued to exhibit similar operational models, victimology, and extortion methodologies.
Analyst Comments
Collectively, the similarities between the groups suggest the possibility of a shared criminal ecosystem, affiliate network, or loosely connected threat cluster rather than entirely independent operations. The emergence of Helix further reflects the broader trend of extortion groups rebranding or fragmenting while retaining proven attack techniques and operational infrastructure to support their criminal activities. Despite suspicion of these groups’ connectivity, the exact nature of the relationship remains unconfirmed. As Helix focuses on identity-based attack techniques to gain access to Microsoft 365 environments, Arete recommends that organizations remain vigilant in using MFA, enforcing strong identity security controls, continuously monitoring authentication activity, and enhancing user awareness of social engineering tactics.
Sources
Helix, a New Name in the Data Extortion Ecosystem?
BlackFile actively extorting data-theft victims in retail and hospitality sector
"Pink" Data Extortion Group Hunting With Evasive Phishing Kits