Cisco Talos Released a Free Decryptor for Flawed Thanatos Ransomware

Cisco Talos released a free ThanatosDecryptor for victims of the Thanatos ransomware, a strain whose broken encryption routinely made files unrecoverable even after ransom payment. Researchers said Thanatos encrypted files with per-file AES-256 keys derived from a weak GetTickCount system-uptime value, then failed to preserve those keys, leaving victims unable to rely on the attackers for restoration. The malware renamed files with the .THANATOS extension, dropped a README.txt ransom note, created a Windows autorun registry entry to reopen the note at login, and in some cases contacted an iplogger.com URL to track infections.

Talos said Thanatos spread in multiple campaigns, including via Discord attachments, and that some variants appeared designed to destroy data rather than support payment and decryption. The ransom note demanded about $200 and accepted Bitcoin, Ethereum, and Bitcoin Cash, making it one of the first ransomware families reported to take Bitcoin Cash, yet observed wallet activity suggested the operator earned only about $720 in total and some listed wallets were invalid or unused. Talos open-sourced its decryptor and said recovery works best on the same machine where encryption occurred, with support limited to certain file types by narrowing the 32-bit uptime-derived key space using Windows Event Log data and file timestamps.