Cybersecurity Breakthrough Cracks DarkBit Ransomware Encryption
Cybersecurity firm Profero has cracked the encryption used by DarkBit ransomware, allowing victims to recover files without paying ransoms. The breakthrough follows an attack in 2023 that targeted multiple VMware ESXi servers and demanded 80 Bitcoin. Researchers discovered critical weaknesses in the ransomware’s key generation process.
The attack began in 2023 when DarkBit ransomware infected VMware ESXi servers, encrypting virtual machine disks (VMDK files). Attackers demanded 80 Bitcoin and left ransom notes containing political messages against Israel. Profero was called in to investigate and soon identified flaws in the encryption.
The decryption breakthrough means victims no longer need to pay ransoms to recover their data. Profero’s findings also expose vulnerabilities in DarkBit’s encryption, reducing the ransomware’s effectiveness. However, the decryptor remains unreleased, leaving some victims still waiting for access.
