‘Garmin has paid ransomware ransom’

Garmin appears to have paid for the decryptor of the WastedLocker ransomware that hit it last month. BleepingComputer managed to get their hands on this decryptor and since there is no known vulnerability in the algorithm, payment has probably been made.

BleepingComputer has acquired a software package that would come from Garmin’s IT department. It contains the decryptor and a number of security applications. The former contains references to the companies Emsisoft and Coveware, a cybersecurity company that makes decryptors based on decryption keys and a ransomware negotiator respectively. Emsisoft says it has never been involved in negotiations and Coveware declines to comment.

BleepingComputer is not sure how much Garmin paid. It has been informed by an employee that the hostage takers demanded ten million dollars in ransom.

While paying the ransom in itself has an obvious drawback, it involves more than that. BleepingComputer writes that the group behind this ransomware, Evil Corp, is on the US sanctions list, so paying the ransom could mean Garmin could be fined by the US government.

Garmin, which makes smartwatches and navigation systems, among other things, was hit by the ransomware on July 23, which interrupted many of its online systems. Four days later, on July 27, the services began to come back online.