RedStar Ransomware

In our recovery lab today at Lockbit Decryptor, we isolated the RedStar ransomware strain. Our analysis confirms this is not a sophisticated enterprise-grade threat but a variant of the open-source HiddenTear ransomware. This variant uses a simple XOR cipher with a hard-coded key, appending the .RedStar extension. Despite its playful ransom note, the encryption is…