Kaseya Obtains Universal Decryptor for REvil Ransomware

Despite Decryption, the Nightmare Isn’t Over

Even though the master decryption key has been acquired, the attack should not be considered to be over, researchers warned. For one thing, REvil is known for its double-extortion attacks, where company data is stolen in addition to being hit with ransomware.

“The group may still have copies of data stolen from victims,” Righi said. “The group could use this data to extort victims or auction off the data, as it has done in the past on its website Happy Blog.”

Erich Kron, security awareness advocate at KnowBe4, noted that remediation will take more than simply applying the unlocking mechanism to files.

“Significant damage has been done already in the way of downtime and recovery costs, both currently and in the future,” he noted via email. “Even with the data decrypted, there are significant costs associated with restoring devices and data. Simply decrypting the data does not resolve issues that remain, such as potentially installed back doors the attackers could use at a later date. This means there is still a lot of work ahead.”

Tim Wade, technical director on the CTO team at Vectra, said that there could be other nasty surprises for victims to watch out for following the attacks.

“From a distance, the emergence of a master key may appear more comforting than it should,” he warned. “The value of accelerating the restoration of data and services shouldn’t be trivialized, but it won’t exactly erase the already extensive cost of these attacks. And this is a cost carried both in terms of the historic disruption, but also given the proclivity of these criminal operators to leave lingering backdoors, the ongoing need to rebuild compromised infrastructure into a clean, trustworthy state. So yes, sidestepping how this key may have been acquired, it may have some positive outcomes but as they say – it isn’t over ’til it’s over.”