Uptime-Based Key Generation Enables File Recovery From Two Akira-Branded Encryptors

A researcher reported a key-generation weakness in two Akira-branded Windows ransomware builds that enables file recovery without the attacker’s RSA private key. The encryptors seed a fresh Yarrow-256 generator using only the machine’s uptime counter, represented as a decimal string. This reduces key recovery from searching a cryptographic keyspace to searching plausible encryption times at millisecond granularity. An initial blind test recovered four documents and images byte-for-byte, with searches taking roughly 30 minutes per file and one requiring an additional 21-minute pass.

Further tests recovered six of seven in-scope files on each build in about 25 seconds per file using the unchanged decryptor. Both remaining PDFs were subsequently recovered after a PDF-aware validation check was added: their keys were already within the search window, but the generic check could not recognize compressed content in a ChaCha8-encrypted section. The researcher published a decryptor, detections and case materials. Responders should preserve encrypted originals and timing evidence, verify whether the encryptor matches a tested build, and validate recovered files; these results do not establish universal Akira decryptability. Separately, MITRE ATT&CK tracks hidden-window execution as T1564.003, a useful behavioral detection category but not evidence that these encryptors use that technique.