CyberArk has released an online version of " White Phoenix ," an open-source ransomware decryption tool that helps with intermittent encryption .
The software company announced that the tool was already freely available via GitHub, but an online version would certainly be more convenient for ransomware victims who are not as familiar with technology and codes.
Using the new online White Phoenix is very simple. Victims simply need to upload the relevant files, press the “recover” button, and wait for the tool to restore whatever can be recovered.
See also: Ransomware: Significant decrease in the number of victims paying ransom
Currently, the ransomware decryption tool supports files PDF, Word and Excel, ZIP and PowerPointfiles. There is also a file size limit of 10 MB. In case users want to decrypt larger files or virtual machines (VMs), they should use the GitHub version.
White Phoenix targets intermittent encryption
Intermittent encryption is used by many operations (Blackcat/ALPHV, Play, Qilin/Agenda, BianLian, and DarkBit) to speed up the encryption of devices. In essence, it encrypts the victim’s files partially. However, this is also the weakness of the method. Many pieces in a file are not encrypted. If these unencrypted pieces of data contain useful information, especially at the beginning and end of the file, the chances of successfully reconstructing and restoring the file via the online decryption tool increase.
White Phoenix attempts to recover text in documents by concatenating the unencrypted parts and reversing the hex encoding and CMAP (character mapping) scrambling.
Essentially, the tool automates the manual recovery used by data. Therefore, if the above criteria are met, the tool can work quite well.
See also: Education is one of the biggest targets of ransomware
However, according to CyberArk, the strings in the files in order for the decryption tool to work properly. For example, ZIP files must contain the string “PK\x03\x04” and PDFs must contain “0 obj” and “endobj”.
For PDF files that contain image files, CyberArk recommends the “separate files” option for more reliable results.
Even if White Phoenix can't help restore entire systems, it could help restore valuable files or at least some data.
Since there are no more complete tools for the ransomware mentioned above, it is worth trying the online version of White Phoenix.
If you are working with sensitive information, it is recommended that you download White Phoenix from GitHub and use it locally instead of uploading sensitive documents to CyberArk's servers.
☁️ Keep safe copies with Proton Drive
Encrypted cloud storage from Proton — protect your files from ransomware, corruption, and data loss with end-to-end encryption.
- ✔ End-to-end encrypted files & backups
- ✔ Version history — recover files after ransomware
- ✔ Free space — sync across all devices
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
See also: Which new ransomware groups to watch out for in 2024
Ransomware is one of the biggest cyber threats today, which is why users and businesses must take some protective measures:
- Use of reliable and advanced antivirus software
- Create backups foressential files
- Regularly update systems, applications and antivirus programs
- Training employeesto recognize suspicious emails
- Using filters to automatically block suspicious emails
- Use of firewalls and VPNs
- Network segmentation, so that infection cannot spread to all devices
The above security practices can protect users and businesses to a certain extent from various cyber attacks.
Source: www.bleepingcomputer.com
