Ransomware attacks are dominating news headlines, with ransomware-as-a-service (RaaS) operators actively seeking to exploit network vulnerabilities and infect unsuspecting victims. The healthcare sector and financial industry are especially vulnerable to ransomware attacks, as they store valuable personally identifiable data (PII) which can be misused to carry out lucrative crimes, like identity theft and fraud.
During a successful ransomware attack, cyber attackers encrypt this sensitive data, preventing organizations from accessing it. The attackers then demand a hefty cryptocurrency ransom payment in exchange for a decryption key that provides access to it again.
If your organization is infected by ransomware, time is of the essence to prevent further data breaches. Thankfully, there are now many free decryption tools available to help you defend against common variants of ransomware. Read on to learn how to decrypt ransomware and prevent future infections through defensive measures.
Skip ahead to our list of the top 10 free ransomware decryption tools.
How To Recover Data From a Ransomware Attack
In the event of a ransomware attack, follow these steps to recover your data. If you’re not sure what ransomware is, read our guide to ransomware here.
1. Find the Source of Infection
Ransomware spreads quickly once it has entered a target system. Many ransomware or malware types, such as cryptoworms, will actively seek multiple infection points. A fast response is crucial to preventing a costly data breach.
Firstly, you must identify the source of infection and isolate it from all other devices on the network – both physically and electronically.
The isolation process involves:
- Unplugging the device’s power source.
- Disconnecting the device from Wi-Fi and other network connections.
- Removing any connected devices, e.g. external storage.
There’s a high chance that the ransomware has entered through more than one device. You should also treat all devices connected to the first identified source of infection with similar caution and follow appropriate cybersecurity measures.
2. Identify the Type of Ransomware You're Infected With
You’ll need to identify which type of ransomware is infecting your systems to take the most appropriate restorative actions. Kaspersky research shows ransomware is rapidly evolving, with new variants emerging at pace with the growing number of attacks.
While many hackers will identify themselves through the filename of their ransom notes or encrypted files (.exe or .txt). Aside from relying on the file extension, there are also many identification sites now available such as: Crypto Sheriff and ID Ransomware.
Learn more about different types of ransomware.
3. Report to Law Enforcement
Ransomware attackers will demand payment in Bitcoin (or another cryptocurrency) in exchange for a private key to unlock your encrypted files. Most law enforcement agencies urge ransomware victims not to pay the ransom. In many cases, ransom payment only encourages further financial demands and there is no guarantee you will be given access back to your data. Reporting the attack will provide authorities with relevant information to assist in identifying the perpetrators in your case and other similar ransomware attacks.
Learn how to reduce the impact of ransomware attacks.
4. Restore Systems From a Back-Up
Given the rapid development of ransomware and many different types, there is no single way to remove it from your systems. If you have an external backup available, you should completely wipe your systems to restore the original files. Ensure the backup is from a date prior to the ransomware attack to prevent re-infection.
Keep in mind that removing the ransomware doesn’t necessarily decrypt files or restore original files – this can only be done using a ransomware decryptor (if available for the variant of infection). It’s best not to rely solely on these tools and to instead adopt ransomware prevention measures, such as the 3-2-1 backup strategy and installing an anti-malware / anti-virus solution, to protect against future attacks.
Learn how to prevent ransomware attacks.
Top 10 Free Ransomware Decryption Tools
There are currently many free ransomware decryption tools available for some of the most common types of ransomware. Below are the top 10 free decryptor tools to help you recover files encrypted following a ransomware attack.
1. Avast Ransomware Decryption Tools
Avast currently offers 30 free ransomware decryption tools for Microsoft Windows operating systems. Some ransomware variants covered include:
- AES_NI
- Alcatraz Locker
- Babuk
- CrySiS
- CryptoMix (Offline)
- GandCrab
- Globe
- Jigsaw
- Troldesh / Shade
View the full list of Avast’s ransomware decryption tools.
2. AVG
AVG currently offers 7 free ransomware decryption tools, for the following variants:
- Apocalypse
- BadBlock
- Bart
- Crypt888
- Legion
- SZFLocker
- TeslaCrypt
View the full list of AVG’s decryption tools.
3. Emsisoft
Emsisoft currently offers 84 free ransomware decryption tools, such as:
- Babuk
- Cerber
- CryptXXX
- Globe
- Jigsaw
- REvil / Sodinokibi
- Trojan.Encoder.6491
- RSA-NI
- Unknown XTBL
- WannaCry
- Xorist
View the full list of Emisoft’s decryption tools.
4. Kaspersky
Kaspersky currently offers 6 free ransomware decryption tools, for the following variants:
- Shade Decryptor
- Rakhni Decryptor
- Rannoh Decryptor
- CoinVault Decryptor
- Wildfire Decryptor
- Xorist Decryptor
View the full list of Kaspersky’s decryption tools.
5. McAfee
McAfee’s Ransomware Recover (Mr2) is a framework designed to alleviate the time and resources required to develop a decryption framework from members of the cybersecurity community who have decryption keys and decryption logic.
Learn more about McAfee’s Ransomware Recover (Mr2).
6. No More Ransom Project
The No More Ransom Project is a joint initiative by the National High Tech Crime Unit of the Netherlands’ police, Europol’s European Cybercrime Centre, Kaspersky and McAfee. The project aims to help victims of ransomware retrieve their encrypted data and avoid paying ransom to cybercriminals.
Learn more about the No More Ransom Project.
7. Quick Heal
Quick Heal currently offers 20 free ransomware decryption tools, such as:
- Troldesh
- Crysis
- Cryptxxx
- Ninja
- Apocalypse
- STOP Djvu
View the full list of Quick Heal’s decryption tools.
8. Trend Micro
Trend Micro currently offers 27 free ransomware decryption tools, such as:
- Globe / Purge
- Xorist
- CryptXXX v1,v2,v3,v4,v5
- Jigsaw
- Globe/Purge
- Crysis
- WannaCry
View the full list of Trend Mirco’s decryption tools.
9. WannaDecrypt
WannaDecrypt is a free ransomware decryption tool for 5 ransomware variants, including:
- WannaCrypt
- WannaCry
- WanaCrypt0r
- WCrypt
- WCRY
Learn more about WannaDecrypt.
10. Wannakiwi
Based off WannaDecrypt, Wanakiwi is a free ransomware decryption tool for systems affected by WannaCry ransomware.
Final Thoughts
Ransomware decryption tools should only be used in the final stages of a comprehensive ransomware defense strategy if all other security controls fail.
To learn how to implement a series of security controls to reduce the impact of ransomware attacks and potentially avoid the need for decryption tools, read this post.
