Regarding Sicarii's broken decryption process, researchers said that "during execution, the malware regenerates a new RSA key pair locally, uses the newly generated key material for encryption, and then discards the private key."

top 16 comments

sorted by: hot top controversial new old
[–] 141 points 9 months ago (1 child)

Ransomware that can't be decrypted is just destructive malware like any other.

  • source
  • hideshow 1 child comment
  • [+] 73 points 9 months ago (2 children)
  • [–] 39 points 9 months ago (1 child)

    vibe coded and ranswomare in the same sentence was not on my 2026 bingo card

  • source
  • hideshow 1 child comment
  • [–] 38 points 9 months ago

    rofl of course...

  • source
  • [–] 32 points 9 months ago

    Hebrew-based content appears machine-translated

    Did they vibe code their false identity as well?

  • source
  • [–] 37 points 9 months ago

    Like a virus that kills the host, it won't spread as well and should die out faster than other types of maleware.

  • source
  • [–] 13 points 9 months ago (4 children)

    So they basically created a hashing function?

  • source
  • hideshow 4 child comments
  • [–] 56 points 9 months ago (3 children)

    A hash is at least consistent when given identical inputs. What they created is more like a digital incinerator.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 8 points 9 months ago (2 children)
  • [–] 7 points 9 months ago (1 child)

    -u would give you the space back.
    The ransomware doesn't. There is a block of data, sitting there, taunting you.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 3 points 9 months ago

    ehehehehe thanks for that mental image

    Of course, one can always reclaim that space if the data truly is inaccessible. Makes me want to write a joke program for "cleaning up" after ransomware that just removes the data from the partition table (or whatever the equivalent for files is - would that just be rm?)

  • source
  • parent
  • [–] 9 points 9 months ago

    Brilliant lol.

  • source
  • [–] 1 point 8 months ago

    "ransomware can't be decrypted" implies the ransomware itself can't be decrypted, ugh

  • source
  • 1 comment in c/cybersecurity@sh.itjust.works view that post
    [–] 3 points 9 months ago

    That's nothing new. Fake decryption payment have been a thing since Wanacry clones.

  • source