Security Experts:

Connect with us

Hi, what are you looking for?



Free Service Helps CryptoLocker Victims Recover Files

FireEye and Fox-IT have teamed up to provide a new service to assist users whose computers have been infected with the notorious CryptoLocker ransomware.

FireEye and Fox-IT have teamed up to provide a new service to assist users whose computers have been infected with the notorious CryptoLocker ransomware.

CryptoLocker has been designed to encrypt the most important files found on infected computers and keep them that way until victims pay the ransom demanded by the attackers. The threat has helped cybercriminals make millions of dollars from internauts and companies located all over the world.

In June, law enforcement agencies and private sector companies announced that a major takedown operation targeting the Gameover Zeus botnet had also hit CryptoLocker. While new infections have been prevented, there are still a large number of users whose files remain encrypted.

How to get your Files BackFireEye and Fox-IT have managed to obtain many of the private keys associated with the malware, so they’ve launched a free service which they’ve dubbed DecryptCryptoLocker. The service provides users with the private keys needed to decrypt the files encrypted by CryptoLocker, and assistance on how to use them.

In order to recover their files, victims must first identify one encrypted file that is unlikely to contain any sensitive information. They must upload the said file to the DecryptCryptoLocker portal, and provide an email address to which the private key can be sent.

Users are then instructed to download a command-line tool called Decryptolocker.exe and wait for the key for their encrypted files to be delivered via email. Once the key is obtained, the tool must be executed in the Windows Command Prompt by using the following syntax: Decryptolocker.exe –key “<key>” <Lockedfile.doc>

In a blog post published on Wednesday, FireEye has clarified that there are several CryptoLocker variants and it’s possible that the DecryptCryptoLocker tool will only work for some of them. Furthermore, while the companies have obtained a large number of keys, there’s no guarantee that they’ll be able to help all victims.

“We are excited to work with Fox-IT to offer a free resource that can help thousands of businesses affected by the spread of CryptoLocker over the last few months,” noted Darien Kindlund, director of threat intelligence at FireEye. “No matter the type of cyber breach that a business is impacted by, it is our goal to resolve them and get organizations back to normal operations as quickly as possible.”

“The criminals continue to push the boundaries; Fox-IT’s InTELL team and FireEye have shared expertise and investment to deliver a free service that demonstrates there are plenty of good guys who are there to help those who are the victims of the criminals,” explained Andy Chandler, senior vice president at Fox-IT.

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Expert Insights

Related Content


Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.


The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.


The FBI dismantled the network of the prolific Hive ransomware gang and seized infrastructure in Los Angeles that was used for the operation.

Malware & Threats

Microsoft plans to improve the protection of Office users by blocking XLL add-ins from the internet.


A new study by McAfee and the Center for Strategic and International Studies (CSIS) named a staggering figure as the true annual cost of...


Video games developer Riot Games says source code was stolen from its development environment in a ransomware attack


CISA, NSA, and MS-ISAC issued an alert on the malicious use of RMM software to steal money from bank accounts.

Application Security

PayPal is alerting roughly 35,000 individuals that their accounts have been targeted in a credential stuffing campaign.