Our WhiteLock Recovery: Rapid Triage, Expert-Engineered WhiteLock (family: Win32/Ransom.WhiteLock) is actively encrypting Windows environments and appending the .fbin extension. The threat actors drop a ransom note named c0ntact.txt, demand 4 BTC, and set a 4-day deadline. They claim data theft and direct victims to a Tor site where you authenticate with a client ID from…
Overview BB is a crypto-ransomware strain in the MedusaLocker family that encrypts user data and appends the extension .BB to every affected file (for example photo.jpg → photo.jpg.BB). Victims find a ransom note file named Recovery_Instructions.html in every folder where files were encrypted. The ransom note lists Tor links and two contact emails (dec_helper@excic.com and…
What 0xxx does to your data? 0xxx is a crypto-style ransomware that appends the extension .0xxx to files it encrypts (for example photo.jpg → photo.jpg.0xxx). In every compromised folder it drops a ransom note named !0XXX_DECRYPTION_README.TXT, explaining how to contact the attackers and demanding payment for decryption. Related article: How to remove Prey (.prey35) ransomwar…
Overview & Quick Facts Prey is a MedusaLocker-family ransomware sample observed appending the extension .prey35 to encrypted files and dropping a desktop ransom note titled HOW_TO_RECOVER_DATA.html. The actors claim RSA + AES hybrid encryption and data exfiltration; they pressure victims with a 72-hour escalation window. Related article: How to remove MedusaLocker (.stolen9 ransomware) from servers…
How Does Our Decryptor Work? 1. Advanced Cryptographic Reconstruction Our decryptor utilizes deep reverse-engineering of the MedusaLocker .stolen9 encryption routines. Through behavioral and static analysis, we reconstructed the encryption key flow and designed a module capable of identifying and mapping the public key–session key relationship used by this ransomware family. Related article: How to Decrypt…
Our Proton/Shinra Decryptor: Rapid Recovery, Expert-Engineered Our team reverse-engineered the Proton / Shinra family behavior and developed an enterprise-grade decryptor and recovery workflow tailored to .jj3-style infections. Built for Windows, Linux, and VMware ESXi environments, our solution emphasizes safety, repeatability, and measurable integrity checks so you restore files without guesswork. Key promises: rapid assessment, ID-based…
Our TENGU Decryptor: Rapid Recovery, Expert-Engineered At this time there is no publicly verified decryptor for TENGU. Our focus is rapid containment, clean restoration, and forensics-led recovery that preserves evidence, minimizes downtime, and meets regulatory needs. We combine incident response, snapshot restoration, and safe data handling aligned to trusted guidance. Related article: How to Decrypt…
Our C77L Decryptor: Rapid Recovery, Expert-Engineered Our expert team has reverse-engineered the encryption logic behind the C77L / Nullhexxx ransomware family, which appends extensions such as.[nullhex@2mail.co].386355D7 to encrypted files. Our decryptor is specifically designed for Windows, Linux, and VMware ESXi environments, ensuring secure, consistent, and efficient recovery. Related article: How to Decrypt Wiper Ransomware (.ahG5ooth)…
Our Wiper Recovery Engine: Precision, Safety, and Forensic Discipline Our cybersecurity recovery team has studied the .ahG5ooth extension ransomware (a suspected wiper-style malware) that appears to encrypt or wipe data and leave RECOVERY.txt or RECOVERY.hta ransom files. We have constructed a specialized recovery engine designed for Windows, NAS (file servers), and mixed environments that handles…
Restore Encrypted Files Safely and Efficiently The Privaky ransomware (.lbon) is a newly surfaced encryption threat derived from the Chaos ransomware family, capable of locking your files and demanding ransom payments in Bitcoin. Designed to paralyze victims by encrypting documents, databases, and media, Privaky has already impacted individuals and organizations globally. This guide explores every…
