Loading story…
Security researchers released free decryptors for the Yatron and FortuneCrypt ransomware families after finding flaws in how both strains implemented encryption. Yatron, a Hidden Tear-based variant that appends the .Yatron extension to encrypted files, and FortuneCrypt, a Crypren-family ransomware sample compiled with BlitzMax and written in Blitz BASIC, can now be decrypted through updates added to the RakhniDecryptor tool.
The report said defenders had blocked more than 600 Hidden Tear/Trojan-Ransom.MSIL.Tear infections and more than 6,000 Crypren-family attacks over the previous year, with several countries identified as the most affected. The release gives victims of both ransomware families a recovery option without paying attackers and adds relevant malware hashes as indicators of compromise for detection and response.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
Kaspersky announced decryptors for the Yatron and FortuneCrypt ransomware strains after analysts identified weaknesses in their cryptographic implementations. Both decryptors were added to the RakhniDecryptor tool and made available through Kaspersky support and the No More Ransom project.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Law enforcement and industry partners released a free **No More Ransom** decryption tool for victims of **GandCrab** ransomware, offering recovery support for most known variants of one of 2018’s most widespread ransomware families. Europol said the tool was developed with the Romanian Police, international law enforcement partners, and Bitdefender, and came after GandCrab had infected nearly half a million victims worldwide while demanding payments ranging from **$300 to $6,000** in **Bitcoin** or **DASH**. The release marked a significant disruption of a ransomware-as-a-service operation that had scaled rapidly through affiliate partnerships across the cybercrime ecosystem. GandCrab had spread through multiple delivery channels, including malspam campaigns disguised as receipts or order notices and payloads hosted on compromised legitimate websites. Reporting from Cisco Talos and BleepingComputer described infection chains using ZIP archives, macro-enabled Word documents, VBScript, fake CAPTCHA pages, and PowerShell-based downloaders, with some campaigns also abusing compromised sites and `certutil.exe` to retrieve payloads. Once executed, GandCrab encrypted files, appended the `.CRAB` extension, altered desktop wallpapers, and communicated through infrastructure including Tor and **Namecoin `.bit` domains**, underscoring both the scale of the threat and the practical value of the newly released decryptor.
Aug 15, 2026
Cisco Talos released a free **ThanatosDecryptor** for victims of the Thanatos ransomware, a strain whose broken encryption routinely made files unrecoverable even after ransom payment. Researchers said Thanatos encrypted files with per-file AES-256 keys derived from a weak `GetTickCount` system-uptime value, then failed to preserve those keys, leaving victims unable to rely on the attackers for restoration. The malware renamed files with the `.THANATOS` extension, dropped a `README.txt` ransom note, created a Windows autorun registry entry to reopen the note at login, and in some cases contacted an `iplogger.com` URL to track infections. Talos said Thanatos spread in multiple campaigns, including via Discord attachments, and that some variants appeared designed to destroy data rather than support payment and decryption. The ransom note demanded about **$200** and accepted **Bitcoin, Ethereum, and Bitcoin Cash**, making it one of the first ransomware families reported to take Bitcoin Cash, yet observed wallet activity suggested the operator earned only about **$720** in total and some listed wallets were invalid or unused. Talos open-sourced its decryptor and said recovery works best on the same machine where encryption occurred, with support limited to certain file types by narrowing the 32-bit uptime-derived key space using Windows Event Log data and file timestamps.
Aug 15, 2026
Avast released a free decryptor for **TargetCompany ransomware**, also tracked as **Mallox**, allowing some victims to recover encrypted files without paying. The tool works by cracking the decryption password from a pair of matching encrypted and original files, a CPU-intensive process that can take **tens of hours** but only needs to be completed once per affected device; interrupted cracking sessions can also be resumed. Researchers said the ransomware has been active since mid-2021, commonly appending extensions including `.mallox`, `.exploit`, `.architek`, and `.brg`, and dropping the ransom note **`HOW TO RECOVER !!.TXT`** in affected folders. Technical reporting shows the malware prepares systems for encryption by deleting **shadow copies**, altering boot and recovery settings, assigning privileges, enumerating drives, and terminating processes that could lock valuable data such as databases and backup-related services. Avast said file encryption uses **ChaCha20**, with key protection involving **Curve25519** and **AES-128**, while later threat intelligence linked Mallox to a more active double-extortion operation that uses a .NET loader, in-memory payload decryption, victim data exfiltration, and a leak site, with some observed process-killing behavior suggesting possible interest in critical infrastructure and operational technology environments.
Aug 15, 2026