Security researchers have released a decryptor that allows victims of Planetary ransomware to recover their files for free.
The decryptor released by Emsisoft asks the victim to have a copy of the ransom note left by the hackers. It’s not hard to find. Planetary ransomware, which earns its name for its use of planet-related file extensions, including “.Pluto” and “.Neptune,” places a copy of its message in every folder it encrypts files in, as well as on the desktop of infected devices.
The note tells victims to contact either “recoverymydata@protonmail.com” or “recoverydata@india.com” via email, which you can see in the screenshot below. The hackers then promise to send a decryptor once victims pay.
Victims will need to download the decryptor, a link available from Bleeping Computer, and save it to their computer's desktop. They will then need to run the decryptor with admin. This will ensure that the tool can recover all files affected by the ransomware.
Once they run the decryptor, they will be asked to select a “ransom note” and click the “Start” button. The utility will then use this “ransom note” to display the decryption key used by the ransomware to encrypt the victim’s files. At this point, the user can enter this decryption key on the screen, select all the drives they would like to decrypt, and click the “Decrypt” button. This will cause the program to search the computer for the relevant file extensions used by the ransomware and, in turn, decrypt them.
