Avast security researchers exploited a weakness in the encryption process of the DoNex ransomware (and Muse, fake LockBit 3.0, and DarkRace) and created a free decryption tool for affected files .
“In collaboration with law enforcement agencies, we have been silently providing the decryption tool to victims of the DoNex ransomware since March 2024,” the research team said.
DoNex ransomware
The DoNex ransomware appeared in early March 2024 and the hackers operating it reported that they had managed to breach multiple companies.
See also: STORMOUS Ransomware claims HITC Telecom breach
Avast researchers observed that DoNex was carrying out targeted attacks and was most active in the US, Italy, and Belgium.
“As of April 2024, DoNex appears to have stopped evolving, as we have not detected any new samples since then. Additionally, the ransomware's TOR website has been disabled“.
Free decryption tool for DoNex ransomware victims
Files encrypted by DoNex ransomware are given a unique extension (victim ID number). The ransom note left by the hackersis called Readme.victimIDnumber.txt. The notes for DoNex and its previous variants are similar and usually mention the name of the ransomware/group (Muse, DarkRace, etc.)
See also: Eldorado ransomware: New threat – Targets VMware ESXi and Windows
Victims can download Avast's decryption tool. After downloading, they are asked to provide a list of drives, folders, and files that have been encrypted. They must also provide an encrypted file and the same file in its original format. This will allow the tool to figure out the password needed to decrypt the remaining files.
“On the final page, you can choose to create backup copies of your encrypted files. These backups may help if something goes wrong during the decryption process. This option is selected by default, which we recommend,” the researchers added.
Ransomware attacks are very dangerous and unfortunately there is not always a decryption tool available (as happened with DoNex). For this reason, organizations and users must take protective measures to avoid being a victim.
See also: BianLian Ransomware hits major US companies
Ransomware protection
Back up your data: One of the most effective ways to protect yourself from a ransomware attack is to regularly back up your data. This ensures that even if your data is encrypted by ransomware, you will have a safe copy that can be restored without paying the ransom.
Update your operating system and software: Out-of-date operating systems and software are vulnerable to cyberattacks. It is important to regularly update your devices with the latest security and software updates to prevent any vulnerabilities that could be exploited by ransomware.
☁️ Keep safe copies with Proton Drive
Encrypted cloud storage from Proton — protect your files from ransomware, corruption, and data loss with end-to-end encryption.
- ✔ End-to-end encrypted files & backups
- ✔ Version history — recover files after ransomware
- ✔ Free space — sync across all devices
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Beware of suspicious emails and links: Ransomware attacks often start with a phishing email or malicious link. It is important to be cautious when opening emails from unknown senders. Also, do not click on suspicious links. These could lead to the installation of DoNex and other ransomware on your device.
Use antivirus software: Installing reputable antivirus software on your devices can help you detect and prevent attacks . Be sure to update your antivirus software regularly to ensure it is equipped to handle new threats.
See also: Brain Cipher apologizes for ransomware attack in Indonesia
Education: One of the most important steps to protect against ransomware is education. It is important to stay up to date on the latest types of ransomware and how they work. Organizations should also train their employees on how to identify and avoid potential attacks.
Implement strong passwords: Weak or easy passwords can make it easier for hackers to gain access to your devices and install ransomware (e.g. DoNex). It is important to use strong and unique passwords and enable two-factor authentication whenever possible.
Use a VPN: A VPN encrypts your internet connection and provides an extra layer of security against ransomware attacks. This is especially important when using public Wi-Fi networks, which are often unsecured and vulnerable to cyberattacks.
Source: www.helpnetsecurity.com
