Loading story…
Cisco Talos released a free ThanatosDecryptor for victims of the Thanatos ransomware, a strain whose broken encryption routinely made files unrecoverable even after ransom payment. Researchers said Thanatos encrypted files with per-file AES-256 keys derived from a weak GetTickCount system-uptime value, then failed to preserve those keys, leaving victims unable to rely on the attackers for restoration. The malware renamed files with the .THANATOS extension, dropped a README.txt ransom note, created a Windows autorun registry entry to reopen the note at login, and in some cases contacted an iplogger.com URL to track infections.
Talos said Thanatos spread in multiple campaigns, including via Discord attachments, and that some variants appeared designed to destroy data rather than support payment and decryption. The ransom note demanded about $200 and accepted Bitcoin, Ethereum, and Bitcoin Cash, making it one of the first ransomware families reported to take Bitcoin Cash, yet observed wallet activity suggested the operator earned only about $720 in total and some listed wallets were invalid or unused. Talos open-sourced its decryptor and said recovery works best on the same machine where encryption occurred, with support limited to certain file types by narrowing the 32-bit uptime-derived key space using Windows Event Log data and file timestamps.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
Cisco Talos released a free tool, ThanatosDecryptor, to help victims recover files encrypted by Thanatos. Talos had found a way to break the ransomware's flawed encryption routine and also open-sourced the decryptor.
Talos said Thanatos Version 1.1 was distributed mainly between February and April 2018. This version expanded payment options to Bitcoin, Ethereum, and Bitcoin Cash and instructed victims to send a MachineID to the attacker by email.
BleepingComputer reported that MalwareHunterTeam discovered the Thanatos ransomware in February 2018. The malware was notable for encrypting files with per-file keys that were not saved, making recovery by paying unlikely.
Cisco Talos reported that Thanatos Version 1 was distributed in mid-February 2018. This early version used a primitive README.txt ransom note and demanded 0.01 BTC.
Talos identified a campaign in which Thanatos was delivered as an attachment through Discord, including a sample named fastleafdecay.exe. One observed sample explicitly stated that decryption was unavailable, leading Talos to assess the campaign was intended to destroy victim data rather than collect ransom.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 15 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
blog.talosintelligence.com
Open sourcebleepingcomputer.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Prometheus emerged as a **Thanos-based ransomware** operation targeting organizations with file encryption, victim-specific extensions, and ransom notes such as `RESTORE_FILES_INFO.txt` and `.hta` variants, while also threatening to leak stolen data through a dedicated extortion site and negotiation portal. Researchers said the group claimed ties to **REvil**, but multiple analyses found no technical evidence to support that assertion, instead linking Prometheus to the leaked Thanos builder and a broader ransomware-as-a-service ecosystem. Reported demands ranged from **$6,000 to $100,000 in Monero**, and the malware was observed terminating backup and security processes, altering services, and disabling protections including **Raccine** to speed encryption and increase pressure on victims. A free **CyCraft decryptor** later offered partial recovery for some Prometheus-encrypted files by brute-forcing the malware's weak tickcount-derived **Salsa20** key generation, a flaw that made decryption feasible when known file structures or magic bytes were available. Its release was followed by the apparent shutdown of Prometheus infrastructure, but closely related **Thanos-derived** strains including **Haron, Spook, and Midas** continued to appear, reusing code, extortion tactics, leak sites, and technical markers such as shared note formats and encryption artifacts. Subsequent reporting tied these families to rebranding and builder reuse rather than a single clear attribution, showing how Prometheus became part of a wider lineage of ransomware operations targeting businesses across multiple sectors and countries.
Aug 15, 2026
Avast released a free decryptor for **TargetCompany ransomware**, also tracked as **Mallox**, allowing some victims to recover encrypted files without paying. The tool works by cracking the decryption password from a pair of matching encrypted and original files, a CPU-intensive process that can take **tens of hours** but only needs to be completed once per affected device; interrupted cracking sessions can also be resumed. Researchers said the ransomware has been active since mid-2021, commonly appending extensions including `.mallox`, `.exploit`, `.architek`, and `.brg`, and dropping the ransom note **`HOW TO RECOVER !!.TXT`** in affected folders. Technical reporting shows the malware prepares systems for encryption by deleting **shadow copies**, altering boot and recovery settings, assigning privileges, enumerating drives, and terminating processes that could lock valuable data such as databases and backup-related services. Avast said file encryption uses **ChaCha20**, with key protection involving **Curve25519** and **AES-128**, while later threat intelligence linked Mallox to a more active double-extortion operation that uses a .NET loader, in-memory payload decryption, victim data exfiltration, and a leak site, with some observed process-killing behavior suggesting possible interest in critical infrastructure and operational technology environments.
Aug 15, 2026
Security researchers released free decryptors for the **Yatron** and **FortuneCrypt** ransomware families after finding flaws in how both strains implemented encryption. Yatron, a **Hidden Tear**-based variant that appends the `.Yatron` extension to encrypted files, and FortuneCrypt, a **Crypren**-family ransomware sample compiled with **BlitzMax** and written in **Blitz BASIC**, can now be decrypted through updates added to the **RakhniDecryptor** tool. The report said defenders had blocked more than **600** Hidden Tear/`Trojan-Ransom.MSIL.Tear` infections and more than **6,000** Crypren-family attacks over the previous year, with several countries identified as the most affected. The release gives victims of both ransomware families a recovery option without paying attackers and adds relevant malware hashes as indicators of compromise for detection and response.
Aug 14, 2026