<rss version="2.0"
    xmlns:dc="http://purl.org/dc/elements/1.1/"
    xmlns:content="http://purl.org/rss/1.0/modules/content/"
    xmlns:atom="http://www.w3.org/2005/Atom"
    xmlns:media="http://search.yahoo.com/mrss/">
    <channel><title>Bitdefender Labs</title><description>Daily source of cyber-threat information. Established 2001.</description><link>https://www.bitdefender.com/en-us/blog/labs/</link><image><url>https://download.bitdefender.com/resources/images/favicon/favicon-32x32.png</url><title>Bitdefender Labs</title><link>https://www.bitdefender.com/en-us/blog/labs/</link></image><generator>Bitdefender Blog</generator><lastBuildDate>Thu, 12 Mar 2026 13:18:50 GMT</lastBuildDate><atom:link href="https://www.bitdefender.com/nuxt/api/en-us/rss/labs/free-tools/" rel="self" type="application/rss+xml"/><ttl>1800</ttl><item><title>Bitdefender Releases Decryptor for MortalKombat Ransomware</title><description><![CDATA[A new decryptor for the MortalKombat ransomware is now available for download. Bitdefender has been monitoring the MortalKombat ransomware family since it first appeared online in January this year.

Based on the Xorist ransomware, MortalKombat spreads through phishing emails and targets exposed RDP instances. The malware gets planted through the BAT Loader that also delivers the Laplas Clipper malware. An in-depth description of the ransomware is available in this  Cisco Talos blogpost.


Signs]]></description><link>https://www.bitdefender.com/en-us/blog/labs/bitdefender-releases-decryptor-for-mortalkombat-ransomware</link><guid isPermaLink="false">66d5c3d2d0ec1aefc7d722b8</guid><category><![CDATA[Free Tools]]></category><dc:creator>Bitdefender</dc:creator><pubDate>Tue, 28 Feb 2023 14:00:00 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2023/02/decryptors.jpeg" medium="image"/><content:encoded><![CDATA[A new decryptor for the MortalKombat ransomware is now available for download. Bitdefender has been monitoring the MortalKombat ransomware family since it first appeared online in January this year.

Based on the Xorist ransomware, MortalKombat spreads through phishing emails and targets exposed RDP instances. The malware gets planted through the BAT Loader that also delivers the Laplas Clipper malware. An in-depth description of the ransomware is available in this  Cisco Talos blogpost.


Signs]]></content:encoded></item><item><title>Bitdefender Partnership with Law Enforcement Yields MegaCortex Decryptor</title><description><![CDATA[We have just released a decryptor for the MegaCortex ransomware family. This decryptor was built in cooperation with Europol, the NoMoreRansom Project, the Zürich Public Prosecutor's Office and the Zürich Cantonal Police.


Context

In October 2021, twelve individuals were arrested in an international law enforcement operation against Dharma, MegaCortex and LockerGoga ransomware.

This group was responsible for an estimated 1,800 infections, mostly targeting companies. Following the LockerGoga d]]></description><link>https://www.bitdefender.com/en-us/blog/labs/bitdefender-partnership-with-law-enforcement-yields-megacortex-decryptor</link><guid isPermaLink="false">66d5c3d2d0ec1aefc7d722b4</guid><category><![CDATA[Anti-Malware Research]]></category><category><![CDATA[Free Tools]]></category><dc:creator>Bitdefender</dc:creator><pubDate>Thu, 05 Jan 2023 13:00:00 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2023/01/decryptors.jpeg" medium="image"/><content:encoded><![CDATA[We have just released a decryptor for the MegaCortex ransomware family. This decryptor was built in cooperation with Europol, the NoMoreRansom Project, the Zürich Public Prosecutor's Office and the Zürich Cantonal Police.


Context

In October 2021, twelve individuals were arrested in an international law enforcement operation against Dharma, MegaCortex and LockerGoga ransomware.

This group was responsible for an estimated 1,800 infections, mostly targeting companies. Following the LockerGoga d]]></content:encoded></item><item><title>RanHassan Ransomware Decryptor Now Available</title><description><![CDATA[A new decryptor for the RanHassan ransomware is now available for download. First isolated in May 2022, this family of ransomware seems to primarily target victims in India and Arab-speaking countries.

The tell-tale signs of a RanHassan infection are the presence of ransom notes called ATENTION...ATENTION...ATENTION...ATENTION...ATENTION....hta  referencing [dc.dcrypt@tutanota.com](mailto:dc.dcrypt@tutanota.com) and [dc.dcrypt@mailfence.com](mailto:dc.dcrypt@mailfence.com).


How to decrypt ran]]></description><link>https://www.bitdefender.com/en-us/blog/labs/ranhassan-ransomware-decryptor-now-available</link><guid isPermaLink="false">66d5c3d2d0ec1aefc7d722b0</guid><category><![CDATA[Free Tools]]></category><category><![CDATA[Anti-Malware Research]]></category><dc:creator>Bitdefender</dc:creator><pubDate>Mon, 07 Nov 2022 14:00:00 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2022/11/decryptors.jpeg" medium="image"/><content:encoded><![CDATA[A new decryptor for the RanHassan ransomware is now available for download. First isolated in May 2022, this family of ransomware seems to primarily target victims in India and Arab-speaking countries.

The tell-tale signs of a RanHassan infection are the presence of ransom notes called ATENTION...ATENTION...ATENTION...ATENTION...ATENTION....hta  referencing [dc.dcrypt@tutanota.com](mailto:dc.dcrypt@tutanota.com) and [dc.dcrypt@mailfence.com](mailto:dc.dcrypt@mailfence.com).


How to decrypt ran]]></content:encoded></item><item><title>Bitdefender Releases Universal LockerGoga Decryptor in Cooperation with Law Enforcement</title><description><![CDATA[We’re pleased to announce the availability of a new decryptor for LockerGoga, a strain of ransomware that rose to fame in 2019 with the attack of the Norsk Hydro company.

The new decryptor is a joint effort between Bitdefender, Europol, the NoMoreRansom Project, the Zürich Public Prosecutor's Office and the Zürich Cantonal Police.


What is LockerGoga?

LockerGoga is a family of ransomware identified in January 2019 after successful attacks against several companies in the United States of Amer]]></description><link>https://www.bitdefender.com/en-us/blog/labs/bitdefender-releases-universal-lockergoga-decryptor-in-cooperation-with-law-enforcement</link><guid isPermaLink="false">66d5c3d2d0ec1aefc7d722ad</guid><category><![CDATA[Free Tools]]></category><category><![CDATA[Anti-Malware Research]]></category><dc:creator>Bitdefender</dc:creator><pubDate>Fri, 16 Sep 2022 07:00:00 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2022/11/ransomware-decryption-tools-banner-1.jpeg" medium="image"/><content:encoded><![CDATA[We’re pleased to announce the availability of a new decryptor for LockerGoga, a strain of ransomware that rose to fame in 2019 with the attack of the Norsk Hydro company.

The new decryptor is a joint effort between Bitdefender, Europol, the NoMoreRansom Project, the Zürich Public Prosecutor's Office and the Zürich Cantonal Police.


What is LockerGoga?

LockerGoga is a family of ransomware identified in January 2019 after successful attacks against several companies in the United States of Amer]]></content:encoded></item><item><title>Bitdefender Offers Free Universal Decryptor for REvil/Sodinokibi Ransomware</title><description><![CDATA[**Update: September 20, 2021

We are glad to report that hundreds of victims and counting have been able to decrypt their data. We also wanted to report that we resolved an issue that could affect a small subset of victims using the decryptor in a particular setting. We immediately reconfigured the decryptor and delivered an update within hours. Victims using all encryption modes can safely decrypt their data.

Bitdefender announced the availability of a universal decryptor for REvil/Sodinokibi.]]></description><link>https://www.bitdefender.com/en-us/blog/labs/bitdefender-offers-free-universal-decryptor-for-revil-sodinokibi-ransomware</link><guid isPermaLink="false">66d5c3d2d0ec1aefc7d7229a</guid><category><![CDATA[Free Tools]]></category><dc:creator>Bitdefender</dc:creator><pubDate>Thu, 16 Sep 2021 13:00:00 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2022/11/ransomware-decryption-tools-banner-1-1.jpeg" medium="image"/><content:encoded><![CDATA[**Update: September 20, 2021

We are glad to report that hundreds of victims and counting have been able to decrypt their data. We also wanted to report that we resolved an issue that could affect a small subset of victims using the decryptor in a particular setting. We immediately reconfigured the decryptor and delivered an update within hours. Victims using all encryption modes can safely decrypt their data.

Bitdefender announced the availability of a universal decryptor for REvil/Sodinokibi.]]></content:encoded></item><item><title>New Bitdefender Decryptor for Avaddon Infections</title><description><![CDATA[In February, Bitdefender released a partial decryptor for Avaddon ransomware. We now have an updated version of this tool available for free to help victims get their data back.

Who is Avaddon?

Avaddon is a family of ransom likely operated from within the Commonwealth of Independent States. Active since 2019, it evolved into a fully-fledged Ransomware-as-a-Service (Raas) operation. Like most RaaS businesses, its operators encrypt data, but also exfiltrate important information and threaten the]]></description><link>https://www.bitdefender.com/en-us/blog/labs/new-bitdefender-decryptor-for-avaddon-infections</link><guid isPermaLink="false">66d5c3d2d0ec1aefc7d72293</guid><category><![CDATA[Free Tools]]></category><category><![CDATA[Anti-Malware Research]]></category><dc:creator>Bogdan Botezatu</dc:creator><pubDate>Mon, 21 Jun 2021 22:26:05 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2021/09/ransomware-decryption-tools-banner-1.jpg" medium="image"/><content:encoded><![CDATA[In February, Bitdefender released a partial decryptor for Avaddon ransomware. We now have an updated version of this tool available for free to help victims get their data back.

Who is Avaddon?

Avaddon is a family of ransom likely operated from within the Commonwealth of Independent States. Active since 2019, it evolved into a fully-fledged Ransomware-as-a-Service (Raas) operation. Like most RaaS businesses, its operators encrypt data, but also exfiltrate important information and threaten the]]></content:encoded></item><item><title>Fonix Ransomware Decryptor</title><description><![CDATA[A decryptor for Fonix Ransowmare is now available for download. Also known as FonixCrypter or Xinof, this family of malware was initially spotted in June 2020 and went out of business in late January this year. The news, broken by one of the project’s administrators, also includes master keys and a bare-bones decryptor that can potentially be used to recover one file at a time.

Bitdefender researchers have been working on a free decryptor that can safely help victims get back their ransomed inf]]></description><link>https://www.bitdefender.com/en-us/blog/labs/fonix-ransomware-decryptor</link><guid isPermaLink="false">66d5c3d2d0ec1aefc7d72288</guid><category><![CDATA[Anti-Malware Research]]></category><category><![CDATA[Free Tools]]></category><dc:creator>Bogdan Botezatu</dc:creator><pubDate>Thu, 04 Feb 2021 15:50:13 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2021/09/ransomware-decryption-tools-banner-2.jpg" medium="image"/><content:encoded><![CDATA[A decryptor for Fonix Ransowmare is now available for download. Also known as FonixCrypter or Xinof, this family of malware was initially spotted in June 2020 and went out of business in late January this year. The news, broken by one of the project’s administrators, also includes master keys and a bare-bones decryptor that can potentially be used to recover one file at a time.

Bitdefender researchers have been working on a free decryptor that can safely help victims get back their ransomed inf]]></content:encoded></item><item><title>Darkside Ransomware Decryption Tool</title><description><![CDATA[We’re happy to announce the availability of a decryptor for Darkside. This family of ransomware has emerged in August 2020 and operates operate under a ransomware-as-a-service business model.

How to use this tool

Step 1: Download the decryption tool below and save it on your computer.

Download the Darkside decryptor

Step 2: Double-click the file (previously saved as BDDarkSideDecryptor.exe) and allow it to run.

Step 3: Select “I Agree” in the License Agreement screen

Note: The tool attempt]]></description><link>https://www.bitdefender.com/en-us/blog/labs/darkside-ransomware-decryption-tool</link><guid isPermaLink="false">66d5c3d2d0ec1aefc7d72285</guid><category><![CDATA[Free Tools]]></category><dc:creator>Bitdefender</dc:creator><pubDate>Mon, 11 Jan 2021 12:59:37 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2021/09/ransomware-decryption-tools-banner-3.jpg" medium="image"/><content:encoded><![CDATA[We’re happy to announce the availability of a decryptor for Darkside. This family of ransomware has emerged in August 2020 and operates operate under a ransomware-as-a-service business model.

How to use this tool

Step 1: Download the decryption tool below and save it on your computer.

Download the Darkside decryptor

Step 2: Double-click the file (previously saved as BDDarkSideDecryptor.exe) and allow it to run.

Step 3: Select “I Agree” in the License Agreement screen

Note: The tool attempt]]></content:encoded></item><item><title>MaMoCrypt Ransomware Decryption Tool</title><description><![CDATA[We’re happy to announce the availability of a new decryptor for MaMoCrypt, a strain of ransomware that appeared in December last year.

MaMoCrypt is an unusual piece of ransomware, a variant of MZRevenge written in Delphi and packed using mpress.

If you don’t want to go through the technical analysis, you can jump straight to decryption by downloading the utility below:

Download the MaMoCrypt decryptor


Ransomware behavior

1. MaMoCrypt deletes shadow volumes, disables the firewall and UAC. T]]></description><link>https://www.bitdefender.com/en-us/blog/labs/mamocrypt-ransomware-decryption-tool</link><guid isPermaLink="false">66d5c3d2d0ec1aefc7d72280</guid><category><![CDATA[Anti-Malware Research]]></category><category><![CDATA[Free Tools]]></category><dc:creator>Bitdefender</dc:creator><pubDate>Fri, 16 Oct 2020 12:22:16 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2021/09/ransomware-decryption-tools-banner-4.jpg" medium="image"/><content:encoded><![CDATA[We’re happy to announce the availability of a new decryptor for MaMoCrypt, a strain of ransomware that appeared in December last year.

MaMoCrypt is an unusual piece of ransomware, a variant of MZRevenge written in Delphi and packed using mpress.

If you don’t want to go through the technical analysis, you can jump straight to decryption by downloading the utility below:

Download the MaMoCrypt decryptor


Ransomware behavior

1. MaMoCrypt deletes shadow volumes, disables the firewall and UAC. T]]></content:encoded></item><item><title>WannaRen Decryption Tool</title><description><![CDATA[A decryptor for the WannaRen ransomware is now available for download.

Initially spotted in April 2020, WannaRen is mostly spreading through websites offering “cracked” software. This new decryptor works on all known versions of WannaRen ransomware.

How to use this tool

Step 1: Download the decryption tool below

Download the WannaRen decryptor

Save it somewhere on your computer. The tool doesn’t require an active internet connection.

Step 2: Double-click the file (previously saved as BDWan]]></description><link>https://www.bitdefender.com/en-us/blog/labs/wannaren-decryption-tool</link><guid isPermaLink="false">66d5c3d2d0ec1aefc7d72279</guid><category><![CDATA[Anti-Malware Research]]></category><category><![CDATA[Free Tools]]></category><dc:creator>Bitdefender</dc:creator><pubDate>Wed, 19 Aug 2020 09:38:13 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2021/09/ransomware-decryption-tools-banner-5.jpg" medium="image"/><content:encoded><![CDATA[A decryptor for the WannaRen ransomware is now available for download.

Initially spotted in April 2020, WannaRen is mostly spreading through websites offering “cracked” software. This new decryptor works on all known versions of WannaRen ransomware.

How to use this tool

Step 1: Download the decryption tool below

Download the WannaRen decryptor

Save it somewhere on your computer. The tool doesn’t require an active internet connection.

Step 2: Double-click the file (previously saved as BDWan]]></content:encoded></item><item><title>GoGoogle Decryption Tool</title><description><![CDATA[We’re happy to announce the availability of a new decryptor for GoGoogle (aka BossiTossi) ransomware. This family of ransomware is written in Go and generates encrypted files with the .google extension.

Spotted in April 2020, GoGoogle ransomware has several peculiarities.

First of all, it is written in Golang, a programming language that has grown popular among ransomware creators as of late. Secondly, the two versions of GoGoogle use two distinct encryption methods, depending on the size of t]]></description><link>https://www.bitdefender.com/en-us/blog/labs/gogoogle-decryption-tool</link><guid isPermaLink="false">66d5c3d2d0ec1aefc7d7226d</guid><category><![CDATA[Anti-Malware Research]]></category><category><![CDATA[Free Tools]]></category><dc:creator>Bitdefender</dc:creator><pubDate>Thu, 07 May 2020 08:04:00 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2021/09/ransomware-decryption-tools-banner-6.jpg" medium="image"/><content:encoded><![CDATA[We’re happy to announce the availability of a new decryptor for GoGoogle (aka BossiTossi) ransomware. This family of ransomware is written in Go and generates encrypted files with the .google extension.

Spotted in April 2020, GoGoogle ransomware has several peculiarities.

First of all, it is written in Golang, a programming language that has grown popular among ransomware creators as of late. Secondly, the two versions of GoGoogle use two distinct encryption methods, depending on the size of t]]></content:encoded></item><item><title>Shade / Troldesh Ransomware decryption tool</title><description><![CDATA[We have just released an updated decryption tool for Shade (Troldesh) Ransomware. As a long-established family of ransomware, Shade has been in operation since 2014, and has been operating consistently ever since.

In late April 2020, its operators announced that they are stopping the Shade operation and publicly released around 750,000 decryption keys hinting that cyber-security companies should build a better decryptor than theirs.

TL;DR, just show me the download

You can download the decryp]]></description><link>https://www.bitdefender.com/en-us/blog/labs/shade-troldesh-ransomware-decryption-tool</link><guid isPermaLink="false">66d5c3d2d0ec1aefc7d7226a</guid><category><![CDATA[Anti-Malware Research]]></category><category><![CDATA[Free Tools]]></category><dc:creator>Bitdefender</dc:creator><pubDate>Sat, 02 May 2020 10:27:39 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2021/09/ransomware-decryption-tools-banner-7.jpg" medium="image"/><content:encoded><![CDATA[We have just released an updated decryption tool for Shade (Troldesh) Ransomware. As a long-established family of ransomware, Shade has been in operation since 2014, and has been operating consistently ever since.

In late April 2020, its operators announced that they are stopping the Shade operation and publicly released around 750,000 decryption keys hinting that cyber-security companies should build a better decryptor than theirs.

TL;DR, just show me the download

You can download the decryp]]></content:encoded></item><item><title>Paradise Ransomware decryption tool</title><description><![CDATA[We’re happy to announce a new decryptor for Paradise Ransomware.

Paradise Ransomware, initially spotted in 2017, has been aggressively marketed as a service to interested affiliates. After infection, it checks whether the keyboard language is set to Russian, Kazakh, Belarus or Ukrainian and, if so, exits without encrypting. Otherwise, it encrypts files and deletes shadow copies to prevent the user from restoring them.

After encryption, it displays a ransom message:

The new Bitdefender decrypt]]></description><link>https://www.bitdefender.com/en-us/blog/labs/paradise-ransomware-decryption-tool</link><guid isPermaLink="false">66d5c3d2d0ec1aefc7d7225c</guid><category><![CDATA[Anti-Malware Research]]></category><category><![CDATA[Free Tools]]></category><dc:creator>Bitdefender</dc:creator><pubDate>Thu, 16 Jan 2020 13:20:14 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2021/09/ransomware-decryption-tools-banner-8.jpg" medium="image"/><content:encoded><![CDATA[We’re happy to announce a new decryptor for Paradise Ransomware.

Paradise Ransomware, initially spotted in 2017, has been aggressively marketed as a service to interested affiliates. After infection, it checks whether the keyboard language is set to Russian, Kazakh, Belarus or Ukrainian and, if so, exits without encrypting. Otherwise, it encrypts files and deletes shadow copies to prevent the user from restoring them.

After encryption, it displays a ransom message:

The new Bitdefender decrypt]]></content:encoded></item><item><title>Ouroboros Ransomware decryption tool</title><description><![CDATA[Ouroboros ransomware has been around for more than a year in various forms, operated by different cybercrime groups. Ouroboros, known to spread via Remote Desktop Protocol bruteforce attacks and deceptive downloads, has claimed a significant number of victims worldwide. We’re now happy to announce the availability of a new decryptor that can restore the .Lazarus, and .Lazarus+ file extensions to their original, unencrypted form.

Please note that this tool only works for the Lazarus and Lazarus+]]></description><link>https://www.bitdefender.com/en-us/blog/labs/ouroboros-ransomware-decryption-tool</link><guid isPermaLink="false">66d5c3d2d0ec1aefc7d72254</guid><category><![CDATA[Anti-Malware Research]]></category><category><![CDATA[Free Tools]]></category><dc:creator>Bitdefender</dc:creator><pubDate>Mon, 28 Oct 2019 13:11:58 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2021/09/ransomware-decryption-tools-banner-9.jpg" medium="image"/><content:encoded><![CDATA[Ouroboros ransomware has been around for more than a year in various forms, operated by different cybercrime groups. Ouroboros, known to spread via Remote Desktop Protocol bruteforce attacks and deceptive downloads, has claimed a significant number of victims worldwide. We’re now happy to announce the availability of a new decryptor that can restore the .Lazarus, and .Lazarus+ file extensions to their original, unencrypted form.

Please note that this tool only works for the Lazarus and Lazarus+]]></content:encoded></item><item><title>Good riddance, GandCrab! We’re still fixing the mess you left behind.</title><description><![CDATA[On January 28th 2018, our analysts on watch saw a small blip pop up on the Bitdefender Threat Map. It was one of millions of blips we see daily here at Bitdefender, but that blip marked the birth of a new family of ransomware that would cause great pain to innocent victims around the world. The same blip would show up at least 50,000 more times in the following month and several more million times in the next year. It came to be known as “GandCrab.”

Download the GandCrab decryptor

This family ]]></description><link>https://www.bitdefender.com/en-us/blog/labs/good-riddance-gandcrab-were-still-fixing-the-mess-you-left-behind</link><guid isPermaLink="false">66d5c3d2d0ec1aefc7d72249</guid><category><![CDATA[Anti-Malware Research]]></category><category><![CDATA[Free Tools]]></category><dc:creator>Bogdan Botezatu</dc:creator><pubDate>Mon, 17 Jun 2019 07:15:46 GMT</pubDate><media:content url="https://blogapp.bitdefender.com/labs/content/images/2022/11/ransomware-decryption-tools-banner-1-2.jpeg" medium="image"/><content:encoded><![CDATA[On January 28th 2018, our analysts on watch saw a small blip pop up on the Bitdefender Threat Map. It was one of millions of blips we see daily here at Bitdefender, but that blip marked the birth of a new family of ransomware that would cause great pain to innocent victims around the world. The same blip would show up at least 50,000 more times in the following month and several more million times in the next year. It came to be known as “GandCrab.”

Download the GandCrab decryptor

This family ]]></content:encoded></item></channel>
        </rss>