Article
Ransomware Decryptors for a (varying) fee
Arete Analysis
Ransomware attacks wreak havoc on business operations. Destroying recovery options, instilling fear and panic, and most often creating high levels of stress for IT staff, owners, and operators. A simple, but often costly fix is to just pay the Threat Actor for the decryption utility. While making a payment to an anonymous entity is a highly debated topic, let us assume, for the purposes of this article, that the payment is the only option other than closing your business. Please note, Arete is not advocating to pay ransoms; the choice is entirely a business decision to pursue. This article is intended to provide insight into the various types of decryptors the threat groups provide to unlock your files. We will discuss specific decryptors for some of the more popular variants as well as address subtle nuances between the decryptors.
Full Disk Encryption
Ransomware variants like THT, Mamba, or MCrypt use native or opensource encryption software to encrypt the entire hard drive of the system. Once the TA gains access to the system with administrator privileges, the TA will use a tool like Bestcrypt, DiskCryptor or even Windows Bitlocker to encrypt the full disk. Once encryption is complete, the system reboots and the victims are locked out.
Communication preference: Email usually protonmail, firemail.cc, or cock.li domains
Average ransom payment: $36,000 – $55,000
Preferred currency: Bitcoin (BTC)
Decryptor received: 100% of the time. TA will provide passwords per system for access
Watch out: MCrypt will hold volumes hostage and “re-extort” victims into making multiple payments. During the initial negotiation, the TA will not indicate multiple drives are encrypted. Instead they will negotiate a single amount for initial access to the Operating System; essentially allowing access into Windows. Once access to Windows is regained, victims often surprised to find their “data” partitions are encrypted causing the victim to return to the negotiation table to once again shell out more money to unlock their information.
Notes: After gaining access, the open source encryption tool still needs to be removed otherwise after reboot, the data storage will be locked again.
System Specific Encryption
Ransomware variants like Phobos, Dharma or CryLock are file level encryption. The TA gains access to the system, copies specific encryption executables onto the systems then runs the executables to encrypt the files. The results are files with a new extension appended to the old file name. Sometimes it’s a random sequence of numbers and letters (e.g. *.nocv) or a specific tag (e.g. *[CryLockDecrypt@****.com][1].[ID-*****- COM]). System specific encryption generates a unique key per encrypted system. The ransom note or the file extension may indicate an “ID” that would be different on each system.
CryLock Scanner & Decryptor
Communication preference: Email usually aol.com, protonmail.com, or cock.li domains
Average ransom payment: $27,000 – $500,000
Preferred currency: Bitcoin (BTC)
Decryptor Received: 95% of the time. Certain variants of Phobos and Dharma will attempt to re-extort a second payment if a large discount is negotiated.
Watch out: Phobos, Dharma, and CryLock are a two-step process. The TA will first send a “scanner” tool that needs to be run on every infected system. The scanner will look for the public keys used to encrypt the files, then write that information to a corresponding .txt or .ini file. Those corresponding files need to be sent to the TA in order to generate a decryptor. The TA in return will send the decryptors. The two-step process adds significant overhead due to the running of multiple tools on the infected system as well as the delay with communicating via email. On average after making a payment for the decryptor, clients are who are infected with Phobos are down for approximately 11 days whereas clients who are infected with Dharma experience downtime of about 7.75 days. The high number of days can be attributed to the two-step process and multiple email communications.
Notes: Negotiating with the Phobos and Dharma group can be tricky. These variants are Ransom-as-a-Service (RaaS) model so you’re not dealing with the same core group of people as you would with variants like Ryuk (or now Conti). Negotiating with RaaS groups can also create confusion and complexities with a different operator responding to each email. The groups who deploy these variants also look for exploiting publicly accessible Remote Desktop Protocol (RDP). Disable external access to RDP to lessen the chance of being infected by this variant.
System Specific Encryption with a Universal Option
Ransomware variants like Sodinokibi are file level encryption with a unique ID per system. Once the TA gains access to the network, they release their Sodinokibi ransomware throughout the environment. The systems are infected with a unique randomly generated file extension per system. Their ransom notes are usually within a text file and explain what happened, including if any data was exfiltrated. The group is very organized and can often share information about their victim’s networks including domain information, infected systems, and any stolen data.
Sodinokibi Decryptor
Communication preference: TOR Website via chat room. The ransom note contains a link to the TOR site as well as a unique key to gain access to a private chat room where the negotiations occur.
Average ransom payment: $170,000
Preferred currency: Monero (XMR)
Decryptor received: 100% of the time. Sodin offers a general decryptor which requires the victim to collect the file extensions from all of their infected systems. This can be very tedious once the payment is made, the victim can input any number of file extensions into the input box on the TOR site to generate a decryptor. Sodin will keep that private room open for 30 days after payment allowing victims to return if they find any extensions not previously found. A lesser known secret with Sodin, if you ask nicely for a universal decryptor, the operator may create the decryptor for you; providing a single decryptor that can be used across your network. The universal decryptor certainly saves a lot of time with decrypting files and minimizing the number of times having to launch the TOR browser.
Watch out: Earlier this year, Sodin changed their code base for their encryption payloads causing instability on certain Windows Operating Systems within the master boot files. Using certain security tools after a Sodin outbreak can cause systems to hang during reboot. Sodin encryption is one of the more aggressive encryptions.
Be sure to create a snapshot or backup the files prior to installing any new software or performing live forensics on critical systems.
Notes: Sodin has made headlines throughout 2020 for following Maze with exfiltrating data as well as being the first ransomware group to only accept Monero for payments.
System Specific Encryption with a Universal Option
Ransomware variants like Sodinokibi are file level encryption with a unique ID per system. Once the TA gains access to the network, they release their Sodinokibi ransomware throughout the environment. The systems are infected with a unique randomly generated file extension per system. Their ransom notes are usually within a text file and explain what happened, including if any data was exfiltrated. The group is very organized and can often share information about their victim’s networks including domain information, infected systems, and any stolen data.
Sodinokibi Decryptor
Communication preference: TOR Website via chat room. The ransom note contains a link to the TOR site as well as a unique key to gain access to a private chat room where the negotiations occur.
Average ransom payment: $170,000
Preferred currency: Monero (XMR)
Decryptor received: 100% of the time. Sodin offers a general decryptor which requires the victim to collect the file extensions from all of their infected systems. This can be very tedious once the payment is made, the victim can input any number of file extensions into the input box on the TOR site to generate a decryptor. Sodin will keep that private room open for 30 days after payment allowing victims to return if they find any extensions not previously found. A lesser known secret with Sodin, if you ask nicely for a universal decryptor, the operator may create the decryptor for you; providing a single decryptor that can be used across your network. The universal decryptor certainly saves a lot of time with decrypting files and minimizing the number of times having to launch the TOR browser.
Watch out: Earlier this year, Sodin changed their code base for their encryption payloads causing instability on certain Windows Operating Systems within the master boot files. Using certain security tools after a Sodin outbreak can cause systems to hang during reboot. Sodin encryption is one of the more aggressive encryptions.
Be sure to create a snapshot or backup the files prior to installing any new software or performing live forensics on critical systems.
Notes: Sodin has made headlines throughout 2020 for following Maze with exfiltrating data as well as being the first ransomware group to only accept Monero for payments. eir.co
Universal Encryption
Ransomware variants like Ryuk, WastedLocker, and Dopplepaymer are also file level encryption. These groups will gain access to the network and perform reconnaissance to identify the victim, understand their business, identify critical systems, and delete backups to force their victims into making a payment. The groups can have access to the network for a few hours or upwards of over a month. Ryuk is commonly associated with precursor trojans such as Trickbot and Emotet. Arete has observed Ryuk deployed as quickly as 6 hours after a Trickbot infection. Ryuk infections result with *.ryk appended to the file name. Comparatively, the deployment of WastedLocker is much more calculated with the TA staying on the network for an average of 2 weeks from initial infection to ransomware deployment. Wasted infections result with *.abcwasted appended to the file name where “abc” is a 3 letter abbreviation relating directly to the victims name.
WastedLocker Decryptor
Communication preference: Email usually protonmail.com domains or TOR Website
Average ransom payment: Ryuk $598,000; WastedLocker $2,400,000; Dopplepaymer $304,000
Preferred currency: Bitcoin (BTC)
Decryptor received: 100% of the time. The decryptor received is universal. It is typically a 32-bit executable that will work on any windows OS version. While these groups are known for a high ransom price, their decryptor is probably the simplest to run.
Watch out: WastedLocker is extremely difficult to negotiate. In fact, if negotiation is attempted, they may threaten to increase the ransom by approximately 5% of the ransom per day until it is paid. They are also very slow to respond to email and even post their business hours of UTC 5am- 8am and 5pm-8pm.
Notes: Dopplepaymer has been linked to gaining access to large environments and deploying cryptomining malware before launching their ransomware attack.
Pro Tips to Prevent Ransomware
Attacks
Implement Endpoint, Detection, and Response software such as SentinelOne to monitor the computer systems in use by your organization. SentinelOne uses Artificial Intelligence technology to detect malicious actions and prevent them before they can severely affect the endpoint.
Leverage a Security Operations Center (“SOC”) to monitor computer systems 24 hours a day by 7 days a week. The SOC can instantly respond to triage and mitigate any alerts while keeping your IT personnel focused on maintain business productivity.
Enable Multi-Factor Authentication (“MFA”) on remote access technologies such as VPN and Email.
Use complex passwords with a minimum of 16 alphanumeric characters (non- dictionary words).
Don’t reuse passwords.
Encourage discussion about cybersecurity within the workplace including establishing end user awareness training.
Ensure backups are current, air gapped from the production network, and viable.
Back to Blog Posts
Article
Critical MOVEit Automation Vulnerabilities Disclosed
A security advisory released by Progress Software details critical and high-severity vulnerabilities affecting their MOVEit Automation managed file transfer (MFT) solution. The vulnerabilities, tracked as CVE-2026-4670 and CVE-2026-5174, could allow a threat actor to bypass authentication and escalate privileges, leading to unauthorized access, administrative control, and data exposure. Cybercriminals have leveraged several MFT tools in previous campaigns, including the Accellion File Transfer Application (FTA), Fortra GoAnywhere MFT, and Cleo MFT. Flaws in MFT software are highly targeted by cybercriminals due to the volume and sensitivity of the data they control.
What’s Notable and Unique
MOVEit Transfer was heavily exploited by the Cl0p ransomware group in the summer of 2023. While the window of exploit activity lasted only a few weeks, victim extortion and data leaks continued throughout the remainder of the year, leading to more than 70 class-action lawsuits filed in the U.S.
There is no workaround or hotfix for these vulnerabilities. To fully patch the flaws, MOVEit administrators need to perform a "full install" of the latest version, which will require taking the system offline.
Security researchers have discovered ~1,400 MOVEit Automation instances exposed to the internet, with dozens belonging to U.S. local and state government agencies.
Analyst Comments
While the vulnerabilities patched in Progress Software's recent release differ from the SQL injection vulnerability exploited by the Cl0p ransomware group in 2023, exploitation of CVE-2026-4670 and CVE-2026-5174 could lead to equally impactful outcomes. Beyond the immediate impacts on affected organizations, trusted data-exchange platforms provide threat actors with an avenue to obtain sensitive information and infect partner and supplier environments. Furthermore, Arete has seen the time window between disclosure and weaponization of critical vulnerabilities continue to shrink, especially as threat actors increasingly adopt AI-enabled tooling. As such, organizations should not only implement the patches released by Progress Software, but also hunt for typical post-compromise behavior like enumeration of the underlying database, the creation of new user accounts or users operating with unexpected administrator privileges, and the presence of unauthorized remote monitoring and management (RMM) tools.
Sources
MOVEit Automation Critical Security Alert Bulletin – April 2026 – (CVE-2026-4670, CVE-2026-5174)
From Breach to Courtroom: Inside the MOVEit Exploitation and Mass Litigation
Progress warns of critical MOVEit Automation auth bypass flaw
Article
Ransomware Trends & Data Insights: April 2026
The threat landscape has remained relatively predictable thus far in 2026. In April, Qilin dethroned Akira as the most active threat group for the month. Akira, who had been the top ransomware threat each month since July 2025, was still only slightly behind Qilin and had roughly the same activity level as in March. INC Ransom and DragonForce also remained active threats in April, with those four ransomware groups accounting for half of all ransomware and extortion activity observed by Arete.
Figure 1. Activity from the top 3 threat groups in April 2026
Throughout the month, analysts at Arete identified several trends behind the threat actors perpetrating cybercrime activities:
Multiple ransomware operations continue to leverage the Bring Your Own Vulnerable Driver (BYOVD) technique to disable endpoint security controls prior to ransomware deployment. Qilin has recently been observed leveraging a malicious file loaded via DLL side-loading along with vulnerable drivers, including rwdrv.sys and hlpdrv.sys, to gain kernel-level access and disable security processes. Arete observed Akira using the same vulnerable drivers in multiple engagements dating back to Q3 2025.
DragonForce has leveraged several of the same tools in recent engagements, including the remote desktop application Remotely Agent and the PoisonX.sys vulnerable driver. Additionally, open-source reporting indicates that the group recently used a Python-based backdoor known as VIPERTUNNEL to maintain reliable operator access and evade detection. DragonForce was responsible for over 7% of Arete ransomware engagements in April, and Arete notes increased activity from the group this year compared to 2025.
A social engineering tactic has reemerged in recent months in which threat actors impersonate IT and helpdesk staff via Microsoft Teams to contact employees and attempt to convince them to install remote access tools like Quick Assist, giving the threat actors remote access to the victim’s environment. This tactic was initially observed in late 2024 and early 2025 and was linked to now-defunct groups like Black Basta and Cactus, but has more recently been observed in intrusions linked to the Akira and Payouts King ransomware groups.
Sources
Arete Internal
Article
Payouts King Utilizes QEMU Emulator to Bypass EDR
Researchers recently identified threat actor campaigns leveraging QEMU, a free open-source virtual machine (VM) emulator, to evade endpoint security solutions. Since QEMU acts as a VM within the target environment, endpoint detection tools cannot scan inside the emulator or detect any malicious files or payloads QEMU contains. Although threat actors have been utilizing QEMU maliciously since 2020, recent activity is attributed to the Payouts King ransomware group and a cluster of threat actors believed to be initial access brokers who have also been exploiting the CitrixBleed2 vulnerability CVE-2025-5777.
What’s Notable and Unique
Payouts King has been observed deploying QEMU since November and uses the VM to create a reverse SSH backdoor to evade detection and install various tools, including Rclone, Chisel, and BusyBox.
In a separate campaign, threat actors are exploiting CVE-2025-5777, a Citrix NetScaler vulnerability that allows attackers to bypass authentication. Once they’ve gained initial access, the threat actors use QEMU to deploy tools inside the VM, which are then used to steal credentials, identify Kerberos usernames, perform Active Directory reconnaissance, and set up FTP servers for staging or data exfiltration.
Analyst Comments
Threat actors continue to focus their efforts on defense evasion, often leveraging legitimate, easily accessible tools such as QEMU. The continued use of QEMU by multiple threat actors highlights the effectiveness of these tactics and the difficulty in detecting and defending against them. To counter this campaign, organizations should proactively monitor for unauthorized QEMU installations, abnormal scheduled tasks, and port forwarding rules.
Sources
QEMU abused to evade detection and enable ransomware delivery
Article
Microsoft Teams Continues to be Leveraged in Social Engineering Attacks
Microsoft warns that threat actors are increasingly abusing Microsoft Teams and relying on legitimate tools to gain access and conduct lateral movement within enterprise networks. The threat actors impersonate IT or helpdesk staff to contact employees via cross-tenant chats and trick them into granting remote access for data theft. Microsoft has observed multiple intrusions with a similar attack chain that utilized commercial remote management software, like Quick Assist and the Rclone utility, to transfer files to an external cloud storage service. This tactic, notably associated with Black Basta and Cactus ransomware operations in late 2024 and early 2025, appears to have resurfaced, with similar activity more recently observed in intrusions linked to the Akira and Payouts King ransomware groups.
What’s Notable and Unique
Initial access is achieved by leveraging external collaboration features in Microsoft Teams to allow impersonation of internal support personnel, tricking users into bypassing security warnings. This reflects abuse of legitimate functionality rather than exploitation of a Microsoft Teams vulnerability.
Following initial access, attackers conduct rapid reconnaissance using Command Prompt and PowerShell to assess privileges, domain membership, and opportunities for lateral movement. Persistence is maintained through Windows Registry modifications, after which attackers leveraged WinRM for lateral movement, targeting domain-joined systems and high-value assets, including domain controllers.
Malicious payloads were staged in user-writable directories and executed through DLL side-loading via trusted, signed applications, enabling covert code execution while blending with legitimate activity. Additional remote management tools were also deployed to support broader access, while Rclone or similar utilities were used to stage and exfiltrate sensitive data to external cloud storage.
Analyst Comments
This activity highlights how modern threat actors can leverage trusted collaboration workflows, remote management tools, and stealthy exfiltration techniques to conduct intrusions through a combination of social engineering and misuse of legitimate functionality. Effective defense depends on layered mitigations that combine identity controls, restricted remote administration, endpoint hardening, network protections, and user awareness measures to disrupt attacker activity at multiple stages of the intrusion lifecycle. To mitigate the risk of this and similar campaigns, users should treat external Teams contacts as untrusted by default, and administrators should restrict or closely monitor remote assistance tools while limiting WinRM usage to controlled systems.
Sources
Cross‑tenant helpdesk impersonation to data exfiltration: A human-operated intrusion playbook
Microsoft: Teams increasingly abused in helpdesk impersonation attacks
Payouts King Takes Aim at the Ransomware Throne