Our Bactor Decryptor — Engineered for Safe Data Recovery Our malware analysis and incident response team has developed a custom decryptor workflow for Bactor ransomware, a 2025 ransomware strain designed to both encrypt and exfiltrate data.Once deployed, Bactor locks all major file types with AES and RSA hybrid encryption, adding the “.bactor” extension to filenames…
Understanding the Zarok Threat Zarok ransomware is a data-encrypting malware recently identified through submissions to VirusTotal. Once active, it encrypts files and appends a unique four-character random extension such as .ps8v to each filename. For instance, document.pdf becomes document.pdf.ps8v. After encrypting data, it replaces the victim’s desktop wallpaper and drops a ransom note titled “README_NOW_ZAROK.txt.”…
A New Evolution of the C77L Family A new ransomware variant known as C77L (also referenced as X77C) has emerged, detected in November 2025 in infection reports shared through cybersecurity communities.This version appends a unique 10-character random string followed by the “.OXOfUbfa” extension to encrypted files (e.g., photo.jpg.3n3Q2PsdhA.OXOfUbfa) and drops a ransom note titled “#Restore-My-Files.txt.”…
Our LockBit 3.0 Decryptor — Advanced Recovery for Modern Encryption Our cybersecurity division has engineered a specialized decryptor and workflow for LockBit 3.0 Black, also known as PC Locker 3.0 by Mr.Robot, one of the most sophisticated ransomware strains active in 2024–2025. This version encrypts files using a hybrid AES-256 and RSA-2048 algorithm and appends…
Our GandCrab Decryptor — Professionally Developed for Legacy Infections Our incident response team has developed a specialized decryptor for GandCrab ransomware (v1), a legacy threat family first observed in early 2018. GandCrab is one of the earliest large-scale ransomware-as-a-service (RaaS) operations, known for its widespread use of affiliates and its evolution through versions V1 to…
Our Specialized Monkey Decryptor — Secure and Expert-Engineered Our cybersecurity laboratory has created a dedicated decryptor for Monkey ransomware, a Rust-based crypto-ransomware family that encrypts user data using a combination of AES and RSA algorithms. The decryptor is built to: The decryptor operates in both cloud-assisted and offline (air-gapped) configurations, ensuring adaptability for enterprises and…
Our Phantom Ransomware Decryptor — Professionally Built and Forensically Safe Our research and incident response team has developed a custom decryptor for Phantom ransomware, an evolved threat derived from the open-source Hidden Tear project. Phantom uses strong hybrid encryption (AES-256 and RSA-2048) and adds the “.Phantom” extension to locked files. The decryptor is designed to:…
Our MedusaLocker3 Decryptor — Advanced, Secure, and Analyst-Driven Our cybersecurity specialists have engineered a bespoke decryptor to assist victims of the MedusaLocker3 / Far Attack ransomware family — an evolution of the notorious MedusaLocker threat group. This version encrypts files using AES and RSA hybrid encryption, appending the “.BAGAJAI” extension to each locked file. Our…
Our Radiant Decryptor — Expertly Designed for Secure Restoration Our cybersecurity analysts have developed a dedicated decryptor and recovery protocol for the Radiant Group ransomware, an active crypto-extortion syndicate identified in September 2025. Radiant employs hybrid AES and RSA encryption and engages in multi-level extortion, combining encryption, data leaks, and reputational damage campaigns to pressure…
Our .weax Decryptor — Purpose-Built for Safe Recovery We’ve developed a targeted decryptor and incident workflow for ransomware that appends .weax-style extensions (including cases where filenames end with patterns like help[[yan]].weax). The tool is engineered to: The decryptor supports staged operation modes (cloud-assisted for speed, or fully air-gapped/offline for sensitive environments) and always runs read-only…
