Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Cybercrime

Free Service Helps CryptoLocker Victims Recover Files

FireEye and Fox-IT have teamed up to provide a new service to assist users whose computers have been infected with the notorious CryptoLocker ransomware.

FireEye and Fox-IT have teamed up to provide a new service to assist users whose computers have been infected with the notorious CryptoLocker ransomware.

CryptoLocker has been designed to encrypt the most important files found on infected computers and keep them that way until victims pay the ransom demanded by the attackers. The threat has helped cybercriminals make millions of dollars from internauts and companies located all over the world.

In June, law enforcement agencies and private sector companies announced that a major takedown operation targeting the Gameover Zeus botnet had also hit CryptoLocker. While new infections have been prevented, there are still a large number of users whose files remain encrypted.

How to get your Files BackFireEye and Fox-IT have managed to obtain many of the private keys associated with the malware, so they’ve launched a free service which they’ve dubbed DecryptCryptoLocker. The service provides users with the private keys needed to decrypt the files encrypted by CryptoLocker, and assistance on how to use them.

In order to recover their files, victims must first identify one encrypted file that is unlikely to contain any sensitive information. They must upload the said file to the DecryptCryptoLocker portal, and provide an email address to which the private key can be sent.

Users are then instructed to download a command-line tool called Decryptolocker.exe and wait for the key for their encrypted files to be delivered via email. Once the key is obtained, the tool must be executed in the Windows Command Prompt by using the following syntax: Decryptolocker.exe –key “<key>” <Lockedfile.doc>

In a blog post published on Wednesday, FireEye has clarified that there are several CryptoLocker variants and it’s possible that the DecryptCryptoLocker tool will only work for some of them. Furthermore, while the companies have obtained a large number of keys, there’s no guarantee that they’ll be able to help all victims.

“We are excited to work with Fox-IT to offer a free resource that can help thousands of businesses affected by the spread of CryptoLocker over the last few months,” noted Darien Kindlund, director of threat intelligence at FireEye. “No matter the type of cyber breach that a business is impacted by, it is our goal to resolve them and get organizations back to normal operations as quickly as possible.”

“The criminals continue to push the boundaries; Fox-IT’s InTELL team and FireEye have shared expertise and investment to deliver a free service that demonstrates there are plenty of good guys who are there to help those who are the victims of the criminals,” explained Andy Chandler, senior vice president at Fox-IT.

Advertisement. Scroll to continue reading.
Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

Expert Insights

Related Content

Cybercrime

The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.

Cybercrime

A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Cybercrime

As it evolves, web3 will contain and increase all the security issues of web2 – and perhaps add a few more.

Cybercrime

Luxury retailer Neiman Marcus Group informed some customers last week that their online accounts had been breached by hackers.

Cybercrime

Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.

Cybercrime

Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.

Artificial Intelligence

The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.

Cybercrime

Satellite TV giant Dish Network confirmed that a recent outage was the result of a cyberattack and admitted that data was stolen.