Loading story…
Security researchers said companies claiming to decrypt files locked by Dharma/Crisis ransomware are not defeating the malware’s encryption, which experts described as effectively unbreakable without a flaw or the criminals’ private key. An investigation by Emsisoft and outside researchers challenged Australian firm Fast Data Recovery after it advertised a high chance of recovering Dharma-encrypted files and claimed it could reverse engineer decryption keys, despite specialists including Brett Callow, Michael Gillespie, Bill Siegel, and Fabian Wosar saying no such capability is known to exist.
Separate research by Check Point found that Russian service Dr. Shifro allegedly operated as a broker between victims and ransomware operators, buying decryption keys at a discount and reselling recovery at a markup rather than performing true cryptographic recovery. In a sting operation, Check Point observed the service requesting encrypted samples and then contacting the attacker-side email to negotiate key purchases; the researchers linked the activity to iharauch@gmail.com and identified a likely operator in Moscow, estimating profits of about $1,350 per victim and potentially hundreds of thousands of dollars overall.
TTPs, infrastructure, and targeting history in one profile.
8 events from the most recent confirmed update back to the earliest known activity.
Check Point noted that another set of Dharma master decryption keys was released in March 2017, though these also did not apply to the newer variants it analyzed.
Previously released Dharma master decryption keys from November 2016 and March 2017 became available, but Check Point said they did not cover the newer variants examined in its investigation.
Check Point Research said the Dharma ransomware family, also known as Crisis, was first observed in 2016.
Security experts including Michael Gillespie, Bill Siegel, and Fabian Wosar said there was no known way to decrypt Dharma without the attackers' key and suggested such firms were likely acting as ransom-paying middlemen.
Fast Data Recovery told Callow that his files belonged to the Dharma family, claimed a very high chance of recovery and a 100% success rate in Dharma cases, and said it would reverse engineer the decryption key.
Brett Callow of Emsisoft posed as a customer and submitted files he had encrypted himself to Fast Data Recovery to test its claim that it could recover Dharma-encrypted data.
Check Point Research published findings that Dr. Shifro was not decrypting newer Dharma/Crisis infections cryptographically, but was instead contacting ransomware operators, buying keys, and reselling recovery services at a markup.
On October 20, during Check Point's controlled test, the fake ransomware operator inbox received a message from iharauch@gmail.com asking for decryption help for the same files sent to Dr. Shifro, linking the intermediary to the service.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
theregister.com
Open sourcefeatures.propublica.org
Open sourceresearch.checkpoint.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Sophos reported that the **Dharma** ransomware operation, also known as **CrySis**, continues to profit as a ransomware-as-a-service scheme by targeting small and medium-sized businesses through high-volume intrusions. Investigators said many attacks begin with compromised or poorly secured **Remote Desktop Protocol (RDP)** access, often using stolen credentials purchased on criminal forums, before affiliates move deeper into victim networks and deploy the ransomware payload. The operation relies on a standardized affiliate toolkit built around a menu-driven PowerShell script, **`toolbelt.ps1`**, that automates much of the attack chain for low-skill operators. Sophos said the toolkit combines Windows utilities, legitimate freeware, public exploits, and custom scripts for credential theft with **Mimikatz**, reconnaissance, Active Directory discovery, lateral movement, antivirus disruption, Tor-based communications, and final encryption, while a two-stage decryption process keeps affiliates dependent on core operators for key retrieval and victim support.
Aug 15, 2026
GuidePoint Security's GRIT reported that an entity calling itself **"Ransom Busters"** contacted ransomware victims with unsolicited offers to recover encrypted files and delete stolen data, claiming it had access to ransomware groups' infrastructure and encryption keys. Investigators assessed with moderate confidence that the operation was not a legitimate incident-recovery service but a ransomware affiliate conducting secondary extortion across multiple ransomware-as-a-service ecosystems, including intrusions linked to **DragonForce**, **Settra**, and **Anubis**. In several cases, the outreach arrived before the incidents were publicly disclosed, raising concerns that the sender had direct knowledge of the attacks. GRIT tied the activity together through overlapping tooling and infrastructure, including **SoftPerfect Network Scanner**, **s5cmd**, **Remotely**, a reused local backdoor password, and a shared attacker-controlled hostname. The actor reportedly demanded **$20,000 to $60,000** and pushed for **Bitcoin** payment while using a privacy-focused email service and early pricing demands as part of the scheme. Researchers said the campaign appears designed to divert ransom negotiations and let an affiliate monetize victims outside the normal revenue-sharing model, and they urged organizations to preserve the messages as evidence and work with incident responders and law enforcement rather than pay the actor.
Aug 20, 2026
Researchers analyzed **HildaCrypt**, a Windows ransomware family written in C# that was distributed as a fake XAMPP installer named `xamp.exe` and obfuscated with **ConfuserEx**. Once launched, it created a GUID-named folder under `%AppData%\Roaming%`, ran a batch script, deleted shadow copies, and attempted to stop SQL, backup, and anti-malware services before encrypting files. The malware used **AES-256-CBC** for file encryption, appended the `.HCY!` extension, and stored the AES key and IV in each file after encrypting them with an embedded **RSA-2048** public key; it then dropped an HTML ransom note, `HILDACRYPTReadMe.html`, directing victims to contact the operator by email. A separate development reduced the threat to victims after the ransomware’s developer released HildaCrypt’s master private decryption keys. Researcher **GrujaRS** had initially classified a sample as a STOP ransomware variant, but the author later said it was a HildaCrypt variant, and **Michael Gillespie** confirmed the keys were valid and published a working decryptor. The developer claimed the malware was created for “fun” and educational purposes, said it had not been used against anyone, and indicated development was likely ending as they moved toward legitimate cybersecurity work.
Aug 15, 2026