Free tool to retrieve data encrypted by ransomware launched

VCryptor works by targeting files on infected systems and encrypting them while storing the data in password-protected ZIP archives. The ransomware replaces original files with new ones bearing a specific extension and shows victims a message demanding money. Victims get presented with two options: send Bitcoin or another cryptocurrency to the attackers, or help spread the malware to their contacts in exchange for recovering their files.

ElevenPaths found that VCryptor uses a single encryption key for both locking and unlocking files instead of the standard approach of separate keys. More importantly, the malware developers hardcoded that key directly into the program. ElevenPaths extracted the key from the malware and used it to create a decryptor that restores locked files without requiring ransom payments.

The free tool lives on the No More Ransomware website, which McAfee, Europol, the Dutch police (Politie), and Kaspersky operate together. The site functions as a clearinghouse for decryption tools across different ransomware variants. ElevenPaths has contributed tools before—the team released a decryptor for PopCorn ransomware in previous years.

Interpol and Kaspersky designated May 12 as anti-ransomware day to build awareness around the threat. Craig Jones, who heads cybercrime operations at Interpol, said in the announcement that "these cyberthreats are causing serious harm to people and organizations, which exacerbate an already dire situation in the physical world. Now is the time when we all must come together to stop them."