BitDefender launches free REvil ransomware decryptor

Cyber security software supplier BitDefender has released a universal decryptor for the REvil ransomware, enabling victims of attacks made before 13 July 2021 to restore their files without paying off the cyber criminals.

Developed with assistance from an undisclosed law enforcement partner, the decryption tool can be downloaded from BitDefender’s website for free, along with a step-by-step tutorial on how to use it.

Alongside the unnamed partner, the Romania-headquartered firm is currently engaged in an ongoing investigation into REvil and is unable to comment on specific details relating to the case until authorised to do so by the leaders of the investigation.

However, it said all concerned believed it was important to release the universal decryptor before the completion of the investigation to help as many victims as possible.

Bogdan Botezatu, director of threat research and reporting at BitDefender, told Computer Weekly it was not clear how many victims might be able to take advantage of the tool. “It is next to impossible to estimate how many victims REvil has managed to infect,” he said. “This is because not all victims report infections or reach out for support.”

Decryptors provided by the REvil gang in the past have gained a reputation for being slow and unreliable, leaving many victims not much better off, but Botezatu said that because the new tool had been developed from scratch, it could be used in confidence.

“The decryptor is safe to use and follows industry standards in software development,” he explained. “The decryptor has been thoroughly tested and our labs offer software support for users and companies who may encounter issues during decryption.

“Until now, our decryptors have saved organisations more than $100m in ransoms, helped rescue critical data and kept organisations around the world open for business,” he added.

REvil, which disappeared in mysterious circumstances in July 2021, possibly after its blockbuster cyber attack on Kaseya brought unwelcome heat from law enforcement, reactivated much of its infrastructure earlier this month.

“The decryptor is safe to use and follows industry standards in software development. It has been thoroughly tested and our labs offer software support for users and companies who may encounter issues during decryption”