Free decryption tools now available for Dharma ransomware

Someone leaked the decryption keys for the program online

Computer users who have been affected by the Dharma ransomware and have held onto their encrypted files can now restore them for free. Researchers have created decryption tools for this ransomware strain after someone recently leaked the decryption keys.

Dharma first appeared in November and is based on an older ransomware program known as Crysis. It's easy to recognize files affected by it because they will have the extension: .[email_address].dharma, where the email address is the one used by the attacker as a point of contact.

On Wednesday, a user named gektar published a link to a Pastebin post on the BleepingComputer.com technical support forum. The post, he claimed, contained the decryption keys for all Dharma variants.

Interestingly, the exact same thing happened back in November with the keys for Crysis, Dharma's predecessor, allowing researchers to create decryption tools for it.

It's not clear who gektar is or what his or her reasons were for leaking the Dharma keys. The username appears to have been created on the forum just for this purpose and has had no other activity since then.

There's also no information about how the keys were obtained in the first place. However, they were included in a C header file, which could suggest that the leaker had access to the ransomware program's source code.

The good news is that the leaked keys are real, and researchers from Kaspersky Lab and ESET verified they work. The two companies have updated their Crysis decryption tools -- downloads at Kaspersky RakhniDecryptor and ESET CrysisDecryptor -- to work for Dharma affected files, too.

This should serve as a reminder to ransomware victims to keep a copy of their affected files, even if they decide not to give into attackers' ransom demands. Researchers sometimes find flaws in the encryption implementations of ransomware programs that allow them to break the encryption keys. Other times law enforcement authorities seize command-and-control servers used by ransomware gangs and release the decryption keys.

From time to time, like in this case, the keys find their way online due to unexplained leaks: Maybe a ransomware developer decides to close up shop and publish the keys, or maybe a hacker breaks into a rival gang's servers and releases the keys to harm its operations. The point is: Hold onto those files, for months or even years if you need to.

It's a good idea to check the tools section of the NoMoreRansom.org website regularly. The website is maintained by a coalition of security companies and law enforcement agencies and is frequently updated with new information and decryption tools.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Laura Johnston

MSI GS65 Stealth Thin

If you can afford the price tag, it is well worth the money. It out performs any other laptop I have tried for gaming, and the transportable design and incredible display also make it ideal for work.

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?