Loading story…
Norton has released a free decryption tool for the Midnight ransomware strain after researchers at Gen Digital identified a critical vulnerability in the ransomware's encryption implementation. Midnight, which is based on the leaked Babuk ransomware source code, attempted to enhance its encryption by integrating ChaCha20 and RSA algorithms, but a flaw in the RSA key usage allowed researchers to develop a practical method for partial decryption and data recovery. The ransomware targets most file types except for executables such as .exe, .dll, and .msi, and appends .Midnight or .endpoint extensions to encrypted files. Victims typically find a ransom note referencing file restoration and may also see debug log files created by the malware.
The decryptor, now publicly available, enables organizations and individuals affected by Midnight ransomware to restore their files without paying a ransom. Security experts advise users to retain backup copies of their data to ensure smooth restoration and to use the decryptor as a safe recovery option. The Midnight ransomware's rapid file encryption, based on file size, was intended to improve attack efficiency but ultimately introduced the cryptographic weakness that led to its defeat. This development highlights the risks ransomware operators face when modifying existing malware frameworks and the importance of robust cryptographic implementation.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Norton publicly released a free decryptor for Midnight ransomware, making the recovery tool available to affected organizations and users. A follow-up report the next day confirmed the ransomware had been successfully decrypted.
Researchers at Norton developed a working decryptor for the novel Midnight ransomware, enabling victims to recover encrypted files without paying. This is the core technical breakthrough reported across the references.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Law enforcement and industry partners released a free **No More Ransom** decryption tool for victims of **GandCrab** ransomware, offering recovery support for most known variants of one of 2018’s most widespread ransomware families. Europol said the tool was developed with the Romanian Police, international law enforcement partners, and Bitdefender, and came after GandCrab had infected nearly half a million victims worldwide while demanding payments ranging from **$300 to $6,000** in **Bitcoin** or **DASH**. The release marked a significant disruption of a ransomware-as-a-service operation that had scaled rapidly through affiliate partnerships across the cybercrime ecosystem. GandCrab had spread through multiple delivery channels, including malspam campaigns disguised as receipts or order notices and payloads hosted on compromised legitimate websites. Reporting from Cisco Talos and BleepingComputer described infection chains using ZIP archives, macro-enabled Word documents, VBScript, fake CAPTCHA pages, and PowerShell-based downloaders, with some campaigns also abusing compromised sites and `certutil.exe` to retrieve payloads. Once executed, GandCrab encrypted files, appended the `.CRAB` extension, altered desktop wallpapers, and communicated through infrastructure including Tor and **Namecoin `.bit` domains**, underscoring both the scale of the threat and the practical value of the newly released decryptor.
Aug 15, 2026
Security researchers released free decryptors for the **Yatron** and **FortuneCrypt** ransomware families after finding flaws in how both strains implemented encryption. Yatron, a **Hidden Tear**-based variant that appends the `.Yatron` extension to encrypted files, and FortuneCrypt, a **Crypren**-family ransomware sample compiled with **BlitzMax** and written in **Blitz BASIC**, can now be decrypted through updates added to the **RakhniDecryptor** tool. The report said defenders had blocked more than **600** Hidden Tear/`Trojan-Ransom.MSIL.Tear` infections and more than **6,000** Crypren-family attacks over the previous year, with several countries identified as the most affected. The release gives victims of both ransomware families a recovery option without paying attackers and adds relevant malware hashes as indicators of compromise for detection and response.
Aug 14, 2026
Avast released a free decryptor for **TargetCompany ransomware**, also tracked as **Mallox**, allowing some victims to recover encrypted files without paying. The tool works by cracking the decryption password from a pair of matching encrypted and original files, a CPU-intensive process that can take **tens of hours** but only needs to be completed once per affected device; interrupted cracking sessions can also be resumed. Researchers said the ransomware has been active since mid-2021, commonly appending extensions including `.mallox`, `.exploit`, `.architek`, and `.brg`, and dropping the ransom note **`HOW TO RECOVER !!.TXT`** in affected folders. Technical reporting shows the malware prepares systems for encryption by deleting **shadow copies**, altering boot and recovery settings, assigning privileges, enumerating drives, and terminating processes that could lock valuable data such as databases and backup-related services. Avast said file encryption uses **ChaCha20**, with key protection involving **Curve25519** and **AES-128**, while later threat intelligence linked Mallox to a more active double-extortion operation that uses a .NET loader, in-memory payload decryption, victim data exfiltration, and a leak site, with some observed process-killing behavior suggesting possible interest in critical infrastructure and operational technology environments.
Aug 15, 2026