How to decrypt files encrypted by Rhysida ransomware without the attacker’s private key

Abstract

Ransomware is malicious software that is a prominent global cybersecurity threat. It typically encrypts data in a system, rendering victims unable to decrypt it without the attacker’s private key. Subsequently, victims often pay substantial ransoms to regain access to their data, yet some may still suffer damage or loss. This study examines Rhysida ransomware, which caused significant damage in the second half of 2023, and proposes a decryption method. Rhysida ransomware employed a secure random number generator to generate the encryption keys for data encryption. However, a vulnerability in its implementation enabled us to reconstruct the internal state of the random number generator, resulting in the disclosure of the encryption keys. In a practical time, we successfully decrypted the data infected with Rhysida using the regenerated state. To the best of our knowledge, this is the first successful decryption of data infected by Rhysida. We aim for our findings to contribute to mitigating the harm inflicted by the Rhysida ransomware.