Criminals release universal key for TeslaCrypt ransomware

ESET has released a tool to decrypt files infected with the latest versions of the TeslaCrypt ransomware. The tool was made possible because the criminals released the universal encryption key.

The tool can decrypt files encrypted by versions 3 and 4 of TeslaCrypt. According to the security researchers, these are files that have been given the extensions .xxx, .ttt, .micro or .mp3 by the ransomware.

ESET did not crack TeslaCrypt, but the ransomware propagators have ceased operations. A security researcher contacted the group anonymously and asked them to release the universal master key. To the surprise of the researchers, this was accepted. The website that victims had to visit to pay the ransom now displays the necessary key.

After releasing the encryption key, ESET created a TeslaCrypt decryptor. Existing tools such as TeslaDecryptor have also been updated. Back in March, security researchers warned that version 3.0.1 and newer of TeslaCrypt was virtually impossible to crack. Decryption tools could already be made for older versions of the ransomware, because there were vulnerabilities in the malware.

Why the criminals released the TeslaCrypt key is not clear. BleepingComputer states that criminals have switched to using CryptXXX. That is also ransomware that is difficult to crack, but Kaspersky has released a decryption tool for that too.

Update 08.18: Added information about CryptXXX decryption capability.