securityaffairs.com Open in urlscan Pro
2606:4700:3031::6815:90b  Public Scan

Form analysis
3 forms found in the DOM

GET https://securityaffairs.com

<form method="get" action="https://securityaffairs.com">
  <input type="search" name="s" placeholder="Search.." class="site-search-field" value="">
  <input type="submit" class="sm-icon">
</form>

<form class="comment">
  <div class="row">
    <div class="col-sm-12 col-md-6 col-lg-6">
      <div class="mb-3">
        <input type="name" name="cmnt_auth_name" class="form-control cmnt_auth_name" placeholder="Name">
      </div>
    </div>
    <div class="col-sm-12 col-md-6 col-lg-6">
      <div class="mb-3">
        <input type="email" name="cmnt_auth_email" class="form-control cmnt_auth_email" placeholder="Email">
      </div>
    </div>
    <div class="col-sm-12 col-md-12 col-lg-12">
      <div class="mb-3">
        <textarea name="cmnt_msg" class="form-control cmnt_msg" placeholder="Comments" rows="3"></textarea>
      </div>
    </div>
    <div class="col-sm-12 col-md-12 col-lg-12">
      <input class="cmnt_submit_btn btn btn-blue btn-inline btn-big" type="submit" name="cmnt_submit" value="Leave comment">
      <input type="hidden" name="pid" class="pid" value="MTUwMjA3">
      <input type="hidden" name="parentcommentid" class="parentcommentid" value="0">
    </div>
  </div>
</form>

POST /150207/malware/key-group-ransomware-decryptor.html#wpcf7-f149934-p150207-o1

<form action="/150207/malware/key-group-ransomware-decryptor.html#wpcf7-f149934-p150207-o1" method="post" class="wpcf7-form init" aria-label="Contact form" novalidate="novalidate" data-status="init">
  <div style="display: none;">
    <input type="hidden" name="_wpcf7" value="149934">
    <input type="hidden" name="_wpcf7_version" value="5.8">
    <input type="hidden" name="_wpcf7_locale" value="en_US">
    <input type="hidden" name="_wpcf7_unit_tag" value="wpcf7-f149934-p150207-o1">
    <input type="hidden" name="_wpcf7_container_post" value="150207">
    <input type="hidden" name="_wpcf7_posted_data_hash" value="">
  </div>
  <div class="form-field"><span class="wpcf7-form-control-wrap" data-name="your-email"><input size="40" class="wpcf7-form-control wpcf7-email wpcf7-validates-as-required wpcf7-text wpcf7-validates-as-email" autocomplete="email" aria-required="true"
        aria-invalid="false" placeholder="Your email address" value="" type="email" name="your-email"></span><input class="wpcf7-form-control wpcf7-submit has-spinner" type="submit" value="SIGN UP"><span class="wpcf7-spinner"></span></div>
  <div class="wpcf7-response-output" aria-hidden="true"></div>
</form>

Text Content

WE VALUE YOUR PRIVACY

We and our partners store and/or access information on a device, such as cookies
and process personal data, such as unique identifiers and standard information
sent by a device for personalised ads and content, ad and content measurement,
and audience insights, as well as to develop and improve products.

With your permission we and our partners may use precise geolocation data and
identification through device scanning. You may click to consent to our and our
partners’ processing as described above. Alternatively you may access more
detailed information and change your preferences before consenting or to refuse
consenting. Please note that some processing of your personal data may not
require your consent, but you have a right to object to such processing. Your
preferences will apply to this website only. You can change your preferences at
any time by returning to this site or visit our privacy policy.

MORE OPTIONSAGREE
 * Home
 * Cyber Crime
 * Cyber warfare
 * APT
 * Data Breach
 * Deep Web
 * Digital ID
 * Hacking
 * Hacktivism
 * Intelligence
 * Internet of Things
 * Laws and regulations
 * Malware
 * Mobile
 * Reports
 * Security
 * Social Networks
 * Terrorism
 * ICS-SCADA
 * POLICIES
 * Contact me

MUST READ

UNRAVELING EternalBlue: inside the WannaCry’s enabler

 | 

Researchers released a free decryptor for the Key Group ransomware

 | 

Fashion retailer Forever 21 data breach impacted +500,000 individuals

 | 

Russia-linked hackers target Ukrainian military with Infamous Chisel Android
malware

 | 

Akira Ransomware gang targets Cisco ASA without Multi-Factor Authentication

 | 

Paramount Global disclosed a data breach

 | 

National Safety Council data leak: Credentials of NASA, Tesla, DoJ, Verizon, and
2K others leaked by workplace safety organization

 | 

Abusing Windows Container Isolation Framework to avoid detection by security
products

 | 

Critical RCE flaw impacts VMware Aria Operations Networks

 | 

UNC4841 threat actors hacked US government email servers exploiting Barracuda
ESG flaw

 | 

Hackers infiltrated Japan’s National Center of Incident Readiness and Strategy
for Cybersecurity (NISC) for months

 | 

FIN8-linked actor targets Citrix NetScaler systems

 | 

Japan's JPCERT warns of new 'MalDoc in PDF' attack technique

 | 

Attackers can discover IP address by sending a link over the Skype mobile app

 | 

Cisco fixes 3 high-severity DoS flaws in NX-OS and FXOS software

 | 

Cloud and hosting provider Leaseweb took down critical systems after a cyber
attack

 | 

Crypto investor data exposed by a SIM swapping attack against a Kroll employee

 | 

China-linked Flax Typhoon APT targets Taiwan

 | 

Researchers released PoC exploit for Ivanti Sentry flaw CVE-2023-38035

 | 
 * Home
 * Cyber Crime
 * Cyber warfare
 * APT
 * Data Breach
 * Deep Web
 * Digital ID
 * Hacking
 * Hacktivism
 * Intelligence
 * Internet of Things
 * Laws and regulations
 * Malware
 * Mobile
 * Reports
 * Security
 * Social Networks
 * Terrorism
 * ICS-SCADA
 * POLICIES
 * Contact me

Ad

 * Home
 * Breaking News
 * Cyber Crime
 * Hacking
 * Malware
 * Researchers released a free decryptor for the Key Group ransomware


RESEARCHERS RELEASED A FREE DECRYPTOR FOR THE KEY GROUP RANSOMWARE

Pierluigi Paganini September 01, 2023



RESEARCHERS RELEASED A FREE DECRYPTOR FOR THE KEY GROUP RANSOMWARE THAT ALLOWS
VICTIMS TO RECOVER THEIR DATA WITHOUT PAYING A RANSOM.

Threat intelligence firm EclecticIQ released a free decryption tool for the Key
Group ransomware (aka keygroup777) that allows victims to recover their data
without paying a ransom.

The Key Group ransomware gang has been active since at least January 2023.
EclecticIQ researchers believe that the financially-motivated gang is primarily
Russian speaking.

Ad

The group is a low-sophisticated threat actor that focuses on financial gain by
selling Personal Identifying Information (PII) or initial access to compromised
devices and obtaining ransom money.

The group operates two Telegram channels, the channel keygroup777Tg for the
negotiation of ransoms, and a private (invite only) Telegram channel used by
members to share information on potential victims, doxing, and offensive tool
sharing. EclecticIQ researchers reported that since June 29, 2023, the
ransomware group is likely using the NjRAT RAT to remotely access victim
devices.

The researchers noticed that the ransomware samples contained multiple
cryptographic mistakes that allowed them to create a decryption tool for a
specific ransomware version built on August 03, 2023.  

“Key Group ransomware uses a base64 encoded static key N0dQM0I1JCM= to encrypt
victims’ data. The threat actor tried to increase the randomness of the
encrypted data by using a cryptographic technique called salting. The salt was
static and used for every encryption process which poses a significant flaw in
the encryption routine.” reads the report published by EclecticIQ. “These
mistakes helped analysts to create a decryption tool for this specific version
of Key Group ransomware.”

The tool is still a proof work and may not work on every Key Group ransomware
sample.

The ransomware uses CBC-mode Advanced Encryption Standard (AES) to encrypt files
and sends personally identifiable information (PII) to threat actors. The
ransomware uses the same static AES key and initialization vector (IV) to
recursively encrypt victim data and add the keygroup777tg extension to the
filenames of the encrypted files.  

The Key Group ransomware deletes volume shadow copies using living-off-the-land
binaries (LOLBINs)  and backups made with the Windows Server Backup tool.

The ransomware also disables updates from multiple anti-malware solutions (i.e
Avast, ESET, and Kaspersky) by modifying the hosts file inside the Windows OS.

The ransomware also attempts to disable the automatic launch of the Windows
Error Recovery screen and the Windows Recovery Environment after a failed boot.

The decryptor is a Python script reported in the report along with Indicators of
Compromise (IoCs) for this threat.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, ransomware)





--------------------------------------------------------------------------------

facebook linkedin twitter

--------------------------------------------------------------------------------

Cybercrime Hacking hacking news information security news IT Information
Security Key Group ransomware malware Pierluigi Paganini ransomware Security
Affairs Security News

YOU MIGHT ALSO LIKE

Pierluigi Paganini September 01, 2023

UNRAVELING ETERNALBLUE: INSIDE THE WANNACRY’S ENABLER

Read more
Pierluigi Paganini September 01, 2023

NORTH KOREA-LINKED APT LABYRINTH CHOLLIMA BEHIND PYPI SUPPLY CHAIN ATTACKS

Read more

LEAVE A COMMENT



NEWSLETTER

SUBSCRIBE TO MY EMAIL LIST AND STAY
UP-TO-DATE!



RECENT ARTICLES

UNRAVELING ETERNALBLUE: INSIDE THE WANNACRY’S ENABLER

Hacking / September 01, 2023



RESEARCHERS RELEASED A FREE DECRYPTOR FOR THE KEY GROUP RANSOMWARE

Malware / September 01, 2023



FASHION RETAILER FOREVER 21 DATA BREACH IMPACTED +500,000 INDIVIDUALS

Data Breach / August 31, 2023



RUSSIA-LINKED HACKERS TARGET UKRAINIAN MILITARY WITH INFAMOUS CHISEL ANDROID
MALWARE

Cyber warfare / August 31, 2023



AKIRA RANSOMWARE GANG TARGETS CISCO ASA WITHOUT MULTI-FACTOR AUTHENTICATION

Cyber Crime / August 31, 2023



To contact me write an email to:

Pierluigi Paganini :
pierluigi.paganini@securityaffairs.co

LEARN MORE

QUICK LINKS

 * Home
 * Cyber Crime
 * Cyber warfare
 * APT
 * Data Breach
 * Deep Web
 * Digital ID
 * Hacking
 * Hacktivism
 * Intelligence
 * Internet of Things
 * Laws and regulations
 * Malware
 * Mobile
 * Reports
 * Security
 * Social Networks
 * Terrorism
 * ICS-SCADA
 * POLICIES
 * Contact me

Copyright@securityaffairs 2023



We use cookies on our website to give you the most relevant experience by
remembering your preferences and repeat visits. By clicking “Accept All”, you
consent to the use of ALL the cookies. However, you may visit "Cookie Settings"
to provide a controlled consent.
Cookie SettingsAccept All
Manage consent
Close

PRIVACY OVERVIEW

This website uses cookies to improve your experience while you navigate through
the website. Out of these cookies, the cookies that are categorized as necessary
are stored on your browser as they are essential for the working of basic
functionalities...
Necessary
Necessary
Always Enabled
Necessary cookies are absolutely essential for the website to function properly.
This category only includes cookies that ensures basic functionalities and
security features of the website. These cookies do not store any personal
information.
Non-necessary
Non-necessary
Any cookies that may not be particularly necessary for the website to function
and is used specifically to collect user personal data via analytics, ads, other
embedded contents are termed as non-necessary cookies. It is mandatory to
procure user consent prior to running these cookies on your website.
SAVE & ACCEPT


Go to mobile version