Thread by @BleepinComputer

Kaseya's universal REvil decryption key leaked on a hacking forum - @LawrenceAbrams
bleepingcomputer.com/news/security/…

Yesterday, @pancak3lullz noticed someone posted a link to a screenshot on the XSS forum of an alleged REvil decryptor for ransomware victims.

The person said the decryptor could be used to decrypt all Kaseya victims.

When REvil victims pay a ransom, they are given either a decryptor for a single extension, or a decryptor for the whole campaign.

The screenshot on GitHub was for an REvil universal decryptor that contained the master key for the entire campaign.
github.com/Fr3akaLmaTT3r/…

While some thought this may be the master "operator" key for REvil that can be used to decrypt any victim, @fwosar said that this was unfortunately not the case.

https://twitter.com/fwosar/status/1425275409533476868

To test the decryptor, BleepingComputer encrypted a VM using a sample from the Kaseya attack.

We then proceeded to patch a different REvil universal decryptor with the "OgTD7co7NcYCoNj8NoYdPoR8nVFJBO5vs/kVkhelp2s=" key.

Using this decryptor we were able to decrypt the files on our VM encrypted by the Kaseya sample.

We were not able to decrypt files from other campaigns or victims.

For those who wish to test this process, below are the hashes for a sample and decryptor used in the est.

REvil sample: d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e

Universal decryptor: c2cf2118550a0fd7f81fe9913fe36be24c03a0ae5430b94557e0ee71c550a58c