Originally published on save-my-disk.com — republishing here for the Dev.to security community. Canonical URL preserved.
Ransomware just encrypted your files and the note demands bitcoin. Before any decision, know that paying is neither the only option nor the most reliable. For roughly one ransomware family in three, an official free decryptor exists — published by law enforcement, antivirus vendors, or independent researchers. This guide walks through the full procedure to identify your strain, check if a key is available, and attempt recovery without paying a cent.
The content relies on public resources from Europol, the No More Ransom project, MalwareHunterTeam, the quarterly Coveware and Chainalysis reports, CISA / FBI / ANSSI recommendations, and the Emsisoft decryptor catalog — the spine of ransomware response in 2026.
How modern ransomware encryption works
Understanding the cryptography clarifies why some ransomware is decryptable and other strains are not.
Hybrid AES + RSA encryption
Current ransomware (LockBit, BlackCat, Akira, Royal, Play) uses a hybrid scheme:
- A AES-256 symmetric key (sometimes ChaCha20 or Salsa20) is randomly generated per file or per batch of files.
- This AES key encrypts the actual file content — fast, several gigabytes per minute.
- The AES key itself is encrypted with a RSA-2048 public key (or elliptic curves Curve25519) embedded in the malware.
- The matching RSA private key stays on the attacker's server: without it, the AES keys cannot be recovered and decryption is mathematically impossible.
This design makes brute-force decryption infeasible in 2026: breaking RSA-2048 requires resources beyond major public clouds. A Shor-style quantum attack would need a fault-tolerant quantum computer with around 20 million physical qubits, out of reach before 2035 at the earliest.
Why some strains are decryptable anyway
Free decryptors don't rely on brute force but on implementation errors, key leaks, or server seizures:
- Flawed cryptographic implementation: predictable pseudo-random generator (case of STOP/Djvu offline ID, where the same key is reused when infection happens without C2 contact), nonce reuse, vulnerable cipher mode.
- Master key leak: source-code publication, law enforcement infiltration, affiliate defection. See Babuk (June 2021), Conti (March 2022), LockBit (Operation Cronos 2024).
- C2 server seizure: Europol/FBI operations that recover the private-key database. See GandCrab (2019), partial REvil (2021), Hive (January 2023), LockBit (February 2024).
- Design bug: the key is stored locally in a log file, in the registry, or transmitted in cleartext. Several low-cost families made these mistakes.
For top-tier strains correctly implemented (LockBit 3.0/Black, BlackCat/ALPHV, post-2024 Akira), none of these flaws have been publicly found. They remain undecryptable without the operators' private key.
The No More Ransom project: an essential pivot
Launched in July 2016 by Europol EC3 (European Cybercrime Centre), the Dutch National Police, Kaspersky, and McAfee, the nomoreransom.org portal has become in ten years the global reference for free decryption.
Key 2026 figures
- More than 160 official decryption tools available for download.
- Coverage of roughly 200 ransomware families and sub-families.
- More than 1.8 million victims helped since 2016 (Europol 2025 annual report).
- 188 partners worldwide: law enforcement, CERTs, antivirus vendors, universities.
- Available in 37 languages including English, French, Spanish, German, Japanese.
The Crypto Sheriff service
At the heart of the portal, Crypto Sheriff automatically identifies the strain from two encrypted files (under 1 MB each) and either the ransom note or a URL it contains. The tool compares extensions, file structures, header patterns, and payment addresses against an internal database. When a match is found, it redirects to the matching decryptor and its instructions.
If no tool exists for the strain, the service says so plainly and suggests checking back later — the database is updated weekly.
Limits to keep in mind
The portal does not decrypt online. It provides downloadable tools to run locally. No sensitive file is uploaded to their servers beyond what is needed for identification. The decryptors are signed by partner vendors: Avast, Bitdefender, Emsisoft, Kaspersky, Trend Micro, Tesorion, AVG.
ID Ransomware: the other identification building block
The id-ransomware.malwarehunterteam.com service, maintained since 2016 by Michael Gillespie (joined by MalwareHunterTeam), covers a broader base: over 1,300 families and variants in 2026, more than No More Ransom (which focuses on available decryptors).
How to use it
On the homepage:
- Upload an encrypted file (max size 100 MB, but 1-10 MB is plenty).
- And/or upload the ransom note (TXT, HTML, HTA).
- And/or paste an email address or Tor URL mentioned in the note.
The service compares the file header, the extension, the note content, and network indicators against the database. It returns:
- The canonical family name (e.g., Phobos, STOP/Djvu, MedusaLocker).
- The precise variant if identifiable.
- A direct link to existing recovery resources.
- A "DECRYPTABLE" or "NO DECRYPTOR AVAILABLE" flag.
For deeper accuracy on variants, see our guide on identifying ransomware with ID Ransomware, which details false-positive pitfalls and distinguishing markers between Phobos, Dharma, and Crysis.
Families decryptable for free in 2026
The table below summarizes the main strains with an official tool, the vendor, and the observed success rate.
| Family | Typical extension | Decryptor | Vendor | Success rate |
|---|---|---|---|---|
| STOP/Djvu (offline ID) | .djvu, .stop, .promorad | STOPDecrypter | Emsisoft | 70-90% (offline ID only) |
| Crysis / Dharma | .crysis, .dharma, .wallet | Crysis Decryptor | Avast / Kaspersky | 95% |
| GandCrab v1-v5.2 | .gdcb, .crab, .krab | GandCrab Decryptor | Bitdefender | 99% |
| Shade / Troldesh | .crypted, .breaking_bad | Shade Decryptor | Kaspersky | 95% |
| Avaddon | .avdn | Avaddon Decryptor | Bitdefender | 99% |
| REvil pre-July 2021 | .revil, .sodinokibi | REvil Universal Decryptor | Bitdefender | 90% (time-limited keys) |
| Babuk (leaked keys) | .babuk, .babyk | Babuk Decryptor | Avast | 99% |
| LockBit (Cronos seizure) | .lockbit | LockBit Decryptor | NCA / FBI / Europol | Partial, variant-dependent |
| Conti (source leak) | .conti | Conti Decryptor (limited) | Several researchers | Case by case |
| Hive | .hive | Hive Decryptor | FBI / Europol | Partial (2023 seizure) |
| AES_NI, Jaff, Crysis | various | Dedicated tools | Kaspersky | 90%+ |
| TeslaCrypt | .vvv, .ecc, .ezz, .exx | TeslaDecoder | BloodDolly | 100% (master key released) |
| WannaCry | .wncry, .wcry | wanakiwi / wannakey | Adrien Guinet / Benjamin Delpy | Depends on preserved RAM |
Spotlight on STOP/Djvu: the consumer strain
STOP/Djvu remains in 2025-2026 the most active family against home users (Emsisoft and MalwareHunterTeam reports). It spreads through software cracks, keygens, and trojanized installers downloaded from warez sites.
Two encryption modes:
- Offline ID: no connection to the C2 server during infection. The same key is reused for all victims of the same build. Emsisoft holds that database and can decrypt 70-90% of offline cases.
- Online ID: successful C2 connection, unique per-victim key. Undecryptable without the attackers' private key.
The Emsisoft STOPDecrypter automatically reports the ID type after uploading the personal.txt reference file the malware drops on disk.
Undecryptable families in 2026
Conversely, several active strains have no public decryptor. Don't waste time hunting: preserve the encrypted files and pivot to backup or shadow-copy recovery.
- LockBit 3.0 / Black (post-2022, outside the Cronos-derived keys) — correct cryptography, dominant RaaS.
- BlackCat / ALPHV — Rust-written, multi-OS, operated through mid-2024 then dispersed. No publicly usable seizure.
- Akira — active since 2023, targets SMBs and hospitals, no published flaw.
- Royal / BlackSuit — Conti successor, solid hybrid cryptography.
- Play (PlayCrypt) — active since 2022.
- Medusa, MedusaLocker — active, distinct from each other.
- 8Base — active since 2022.
- Cactus, Rhysida — recent, publicly undecryptable.
For these families, the only viable recovery path is clean backups, undestroyed shadow copies, or unencrypted residual files. See our pillar guide to ransomware file recovery for the full methodology.
Step-by-step: testing an official decryptor
Here is the recommended sequence once the strain is identified and a decryptor is found.
1. Prepare a test environment
- Work on a copy of an encrypted file, never on the original. A decryptor error can irreversibly overwrite the file.
- Create an isolated folder on a clean external drive and copy 5-10 encrypted files of different formats (DOCX, JPG, PDF, MP4, ZIP).
- Pause cloud sync temporarily to avoid propagating partially corrupted decrypted files.
2. Verify decryptor authenticity
Download only from official pages:
- Emsisoft: decrypter.emsisoft.com
- Avast: avast.com/ransomware-decryption-tools
- Bitdefender: bitdefender.com/blog/labs/
- Kaspersky: noransom.kaspersky.com
- No More Ransom: nomoreransom.org/en/decryption-tools.html
Check the executable's digital signature (right-click → Properties → Digital Signatures) and the SHA-256 hash if published. Several fake Bitdefender and Avast decryptors circulate on underground forums with a secondary payload.
3. Confirm the strain with an antivirus scan
Before running the decryptor, scan the machine with an up-to-date AV (ESET, Malwarebytes, Bitdefender free) in offline mode via a rescue USB. Confirm the family detected. If the scan reveals a different strain than the one identified by ID Ransomware, do not run the decryptor — it could damage the files.
4. Run on the copy
Launch the tool, point it to the test folder, and provide the required file pairs (one encrypted file plus one original unencrypted version of the same file, for tools that ask — typically Avast).
Always enable:
- The preserve encrypted files option (in case decryption corrupts them).
- Test mode or dry run if available.
5. Verify the decrypted files
Open each file in its native application:
- DOCX / XLSX: Word/Excel must open it without a repair dialog.
- JPG / PNG: photo viewer, check the full visual appearance.
- PDF: Acrobat or browser, pagination intact.
- ZIP / 7z: integrity test via the archiver's built-in check.
Compare the decrypted file sizes against expected ones (if you have duplicates on cloud storage). A few-byte difference is normal (encryption strips/adds padding and a marker header), but a significant gap signals a problem.
6. Launch full decryption
Once the procedure is validated on the 5-10 test files, target the full volumes and run. Expect several hours for a few hundred gigabytes. Monitor logs: some files may be flagged as partially corrupt (often because the ransomware was interrupted during encryption and left half-processed files).
Alternatives when no decryptor exists
If the strain is on the undecryptable list, don't waste time. Remaining recovery paths:
Restore from backup
This is the most reliable path, provided you have a backup predating the attack, disconnected at the time of encryption. Modern ransomware actively targets attached backup drives and network shares. See the 3-2-1-1-0 best practices in our recovery guide.
Windows shadow copies
Windows creates Volume Shadow Copies (VSS) in the background. Ransomware tries to delete them via vssadmin delete shadows /all, but many miss certain volumes or fail due to privilege issues. Our guide Windows shadow copies and recovery details ShadowExplorer, vssadmin, and the Previous Versions tab for recovery even when VSS appears empty.
File carving
Recovery tools like PhotoRec (free), R-Studio, or EaseUS Data Recovery Wizard scan free disk space for file signatures. When ransomware encrypts a file, it writes the encrypted version then deletes the original — the original is often recoverable as long as the blocks have not been overwritten.
Run the scan immediately after isolating the machine to maximize chances. The longer the disk runs after the attack, the more free blocks get overwritten.
Unencrypted residual files
Several file categories often escape encryption and contain usable data:
-
Office .tmp files in
%APPDATA%\Microsoft\Word\and equivalents for Excel/PowerPoint — auto-saved versions. -
Windows thumbnails in
thumbcache_*.db— viewable with ThumbCache Viewer for photo previews. - Browser history: Chrome/Firefox/Edge caches for recently viewed images.
- Unsynced OneDrive files still in local cache, not yet encrypted depending on timing.
To quickly assess your recovery odds based on your scenario (strain, available backups, media type), use our free diagnostic.
Why you should NOT pay the ransom
Beyond the ethical argument, several technical and legal reasons back the official CISA / FBI / Europol / ANSSI position.
Payment does not guarantee recovery
Coveware Q4 2025 report:
- 8% of paying victims receive no key at all after payment.
- 29% receive a faulty or incomplete decryptor (invalid key on some files, tool crashes, unacceptable performance).
- 63% recover their files but with partial losses (typically 4-15% of files unrecoverable).
- Only around 30% of paying victims recover the entirety of their data.
Compared with 90%+ recovery when an official decryptor exists, the risk/benefit ratio of payment is unfavorable.
Payment funds and encourages the ecosystem
The Chainalysis Crypto Crime Report 2025 estimates global ransomware revenue at about USD 1.1 billion in 2024, down 35% from the 2023 peak — precisely because more victims refuse to pay. Each payment reinforces the business model and invites re-infection: Coveware measures a 78% re-attack rate within 18 months of a successful payment.
Legal risk — OFAC sanctions
In the U.S., the OFAC (Office of Foreign Assets Control) prohibits any transaction with sanctioned entities. Several ransomware groups are listed: Evil Corp (sanctions 2019), Conti / Trickbot operators (2023), individual LockBit operators (2024). Paying a ransomware linked to these groups is a violation exposing the paying entity or facilitator (including negotiation firms) to civil and criminal proceedings.
The EU and the UK are converging on similar rules. In France, Penal Code Article 421-2-2 on terrorism financing can apply if the group is tied to a hostile state (case for several North Korean and Russian groups).
Official CISA / FBI position
The FBI has issued the same message since 2016 through its IC3 advisories. CISA (Cybersecurity and Infrastructure Security Agency) coordinates StopRansomware.gov, which centralizes alerts and decryptors in the United States. The UK's NCSC publishes nearly identical guidance, as does Australia's ACSC.
2025-2026 statistics to remember
| Metric | 2025 value | Source |
|---|---|---|
| Global ransomware victims (identified organizations) | ~5,400 published attacks | Ransomwatch / Ecrime |
| Total ransomware revenue 2024 | ~USD 1.1 billion | Chainalysis 2025 |
| Median ransom demand 2025 | ~USD 340,000 | Coveware Q4 2025 |
| Median ransom paid 2025 | ~USD 117,000 | Coveware Q4 2025 |
| Share of victims who pay | ~29% | Coveware (down from 76% in 2019) |
| Full recovery rate after payment | ~30% | Coveware Q4 2025 |
| Families covered by No More Ransom | ~200 | Europol 2025 |
| Victims helped by No More Ransom | 1.8 million+ | Europol 2025 |
| Families indexed by ID Ransomware | 1,300+ | MalwareHunterTeam |
To anticipate rather than absorb attacks, a modern antivirus with an anti-ransomware module (automatic rollback, behavioral detection) drastically reduces the risk. Our best anti-ransomware software 2026 comparison covers Bitdefender, Norton, Kaspersky, Malwarebytes, and Acronis with their blocking scores from independent AV-Test and AV-Comparatives tests.
Recap: your decision path
- Isolate the machine, photograph the ransom note, record the extension.
- Identify the strain via ID Ransomware (id-ransomware.malwarehunterteam.com).
- Check for a decryptor on No More Ransom (nomoreransom.org).
- If a decryptor exists: download from the official source, test on a copy, then run.
- If no decryptor: restore from clean backup, or attempt shadow copies and file carving on residual files.
- Preserve the encrypted files on an external drive: a decryptor may surface months or years later.
- Do not pay: 70% chance of incomplete recovery, criminal funding, OFAC exposure, 78% re-attack rate.
- File a report with law enforcement (IC3 in the U.S., NCSC/Action Fraud in the U.K., cybermalveillance.gouv.fr in France) and notify your data-protection authority if third-party personal data is involved.
Free decryption truly works for hundreds of thousands of victims every year. The reflex must always be: identification, No More Ransom check, test on a copy, and only then decide on alternatives.
Top comments (0)