Thread by @BleepinComputer

BREAKING: BleepingComputer has confirmed that Garmin received decryptor for their WastedLocker Ransomware attack.
bleepingcomputer.com/news/security/…

BleepingComputer has been able to obtain the decryptor received by Garmin after they likely paid the ransom to the WastedLocker operators.

The decryptor was included in a workstation restoration package created by Garmin's IT department that decrypts a workstation and then installs a variety of security software.

The embedded script clearly indicates that the package was created by the APAC division of Garmin's IT department.

Analysis of the WastedLocker ransomware shows its encryption algorithms to be secure, so it not possible to create a free decryptor. Based on the timestamp in the script, the ransom was likely paid and decryption received on July 24th or 25th.

To confirm that this was a valid decryptor, BleepingComputer encrypted a virtual machine using the WastedLocker sample we discovered used in Garmin's attack. We were then able to use the decryptor to recover our files.

As WastedLocker is attributed to Evil Corp, who has been sanctioned by the US govt, this can become quite a sticky situation for Garmin.
research.nccgroup.com/2020/06/23/was…

Research firm @Arete_Advisors does not believe WastedLocker was created by Evil Corp, so there is opposing research in this area.
areteir.com/wp-content/upl…

Sorry @Twitter, this headline does tell the full story. Get back to tweaking your algorithms.

What we were told. Similar response to our queries.
news.sky.com/story/garmin-p…