Bitdefender releases decryptor for MegaCortex ransomware

January 20, 2023 - TuxCare PR Team

Bitdefender experts have created a universal decryptor for victims of the MegaCortex ransomware family.

MegaCortex has been in use since at least January 2019, and some of the actors who have used it have also been linked to the older Dharma and LockerGoga ransomware variants. The MegaCortex ransomware was occasionally associated with infections by the Qakbot and Emotet malware families and was typically used in corporate network intrusions.

The decryptor was created in collaboration with Swiss and European law enforcement agencies, who conducted raids in October 2021 on the alleged cybercriminals behind the Dharma, MegaCortex, and LockerGoga ransomware strains.

The decryptor is a stand-alone executable that does not require installation and can automatically identify encrypted files on the system. It will decrypt files encrypted by all MegaCortex ransomware variants. It can be downloaded from Bitdefender as well as No More Ransom’s decryption tools portal, which contains 136 free tools for 165 ransomware variants such as Babuk, DarkSide, Gandcrab, and REvil.

The decryptor can also back up the encrypted files for safety in case something goes wrong in the decryption process that could corrupt the files beyond recovery. It also offers an advanced setting to replace undecrytped files with clean files.

Some MegaCortex ransomware attacks have reportedly targeted critical infrastructure and other high-profile targets, with attackers gaining network access through a variety of means, including purchasing access to systems compromised with trojan malware or stealing usernames and passwords.

Authorities from the United States, Switzerland, Ukraine, and other countries disrupted the operation of the MegaCortex ransomware infrastructure in October 2021, arresting 12 people in connection with its deployment. This operation also caused problems with Dharma and LockerGoga.

Despite this, MegaCortex infections have not completely vanished, and BitDefender security researchers have developed a universal decryptor that victims can use to recover encrypted files without paying a ransom. The decryptor was made available as part of the collaborative No More Ransom project run by Europol, the Dutch National Police’s National High Tech Crime Unit, and a number of security firms.

The sources for this piece include an article in BleepingComputer.

Summary