Emsisoft releases new decryptor for STOP Djvu ransomware

[harlan4096]

While STOP (Djvu) may not be as well known as Ryuk and Sodinokibi, with 160 variants, more than 116,000 confirmed victims and an estimated total of 460,000 victims, it is by far the most active and widespread ransomware today. But there’s good news. We’ve just released a free decryption tool for it.

We’ll be breaking STOP’s encryption via a side-channel attack on the ransomware’s keystream. As far as we know, it’s the first time this method has been used to recover ransomware-encrypted files on such a large scale.

STOP is spread almost exclusively through key generators and cracks, which are tools that claim to enable people to activate paid software for free. Children and cash-strapped students commonly seek out these types of tools, which puts them at greater risk of encountering STOP and, by extension, their parents and anyone else who shares a device with them.

To make matters worse, some versions of STOP also bundle additional malware, such as password-stealing Trojans.

Our free decryption tool helps victims to unlock their files without paying the ransom, and can be downloaded from the Emsisoft Decryption Tools page linked below.

Unfortunately, this tool will not work for every victim as it can only recover files encrypted by 148 of the 160 variants. We estimate that this will enable approximately 70% of victims to recover their data. For people affected by the remaining 12 variants, no solution currently exists and we are unable to offer further assistance at this point in time. We recommend that those who find themselves in this position archive the encrypted data in case a solution becomes available in the future.

Download the STOP Djvu Decryptor here

Note: A decryptor for STOP Puma is also available here
...

Continue Reading