2024/02/09 by Giyoon Kim, Soo‐Jin Kang, Kim, Giyoon +7
Computer Science · Social Sciences · #Advanced Malware Detection Techniques #Cryptography and Security (cs.CR) #Digital and Cyber Forensics #FOS: Computer and information sciences #Privacy, Security, and Data Protection
paper · pdf · doi:10.48550/arxiv.2402.06440
openalex publication_date 2024/02/09 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28
Ransomware is malicious software that is a prominent global cybersecurity threat. Typically, ransomware encrypts data on a system, rendering the victim unable to decrypt it without the attacker's private key. Subsequently, victims often pay a substantial ransom to recover their data, yet some may still incur damage or loss. This study examines Rhysida ransomware, which caused significant damage in the second half of 2023, and proposes a decryption method. Rhysida ransomware employed a secure random number generator to generate the encryption key and subsequently encrypt the data. However, an implementation vulnerability existed that enabled us to regenerate the internal state of the random number generator at the time of infection. We successfully decrypted the data using the regenerated random number generator. To the best of our knowledge, this is the first successful decryption of Rhysida ransomware. We aspire for our work to contribute to mitigating the damage inflicted by the Rhysida ransomware.