??Breaking News??: Check out this amazing free tool that can unlock encrypted data in ransomware attacks!

Researchers Release Free Tool on GitHub to Recover Data from Intermittent Encryption Attacks

A group of cybersecurity researchers recently unveiled a new tool on the popular code-sharing platform, GitHub. According to their claims, this tool can effectively assist those who are victims of intermittent encryption attacks in retrieving data from certain partially encrypted files. The best part? This can be achieved without having to succumb to the demands of the attackers and pay a hefty ransom for the decryption key. This groundbreaking development is a significant step towards empowering the victims of ransomware attacks and reducing the influence of cybercriminals.

Understanding Intermittent Encryption Attacks

What are intermittent encryption attacks?

The intermittent encryption technique involves the selective encryption of specific files by a ransomware actor, rather than a comprehensive encryption of the entire file system. This method is employed to speed up the encryption process, impact more files, and make detection harder. Cybercriminals utilize this technique to broaden their reach and increase the chances of successful ransom demands.

Who are the victims of these attacks?

In recent months, several ransomware groups, including BlackCat and Play, have used intermittent encryption in attacks on hundreds of organizations worldwide. The victims of these attacks have included hospitals, banks, and universities - sectors that are critical to society and often more willing to pay ransoms to restore essential services.

The Solution: White Phoenix

What is White Phoenix?

The security vendor Cyberark has successfully developed a cutting-edge tool known as "White Phoenix" that can efficiently automate the process of recovering data from intermittently encrypted documents in a variety of file formats.. The tool is available for free on GitHub, and it has the potential to help victims of these attacks regain access to their data without succumbing to ransom demands.

How Does White Phoenix Work?

Many file formats, such as PDF and Microsoft Office formats, contain specific common parameters. Even if encrypted, these parameters can be reconstructed relatively easily, making data recovery possible. White Phoenix leverages this knowledge to identify and replace encrypted parts of the files, ultimately restoring functionality.

For example, in the event of an intermittent ransomware sample, it has been observed that only the header of a PDF has been encrypted, resulting in a functional file again.

Supported File Formats

White Phoenix supports a variety of file formats, including:

• PDF
• Word formats such as docx and docm
• Excel formats such as xlsx, xltx, and xlsm
• PowerPoint formats such as pptx, pptm, and ppsx
• Zip

To use White Phoenix, users only need to provide the path to the partially encrypted file and a path to a folder to save the recovered content.

Testing White Phoenix

Against BlackCat and Other Ransomware Samples

Researchers from Cyberark put the White Phoenix through a series of tests in which they tested it against the encrypted documents that BlackCat had previously secured. It is suspected that the aforementioned malware variants, namely Play, Qilin, BianLian, and DarkBit, may have limited encryption capabilities, whereas this particular tool is believed to have the potential to encrypt files comprehensively.

Recovery Limitations

In order to facilitate the recovery of partially encrypted files by White Phoenix, it is imperative that there be unencrypted fragments of the data that can be retrieved. In the event that the tool possesses the capability to rectify or substitute the affected segments of the compromised files, it is plausible that the pertinent data enshrined within the file can be salvaged. However, if the encryption is too extensive or there are no salvageable parts, White Phoenix may not be able to help.

The Evolution of Intermittent Encryption Attacks

LockBit Ransomware

The utilization of intermittent encryption has emerged as a recent trend in the cybersecurity landscape, with its origins traced back to the emergence of LockBit ransomware in 2021. Researchers from SentinelOne found that LockFile malware encrypted only every other 16 bytes of a file, just enough to make the files unusable. This approach allowed the threat actor to infect more systems in a shorter time frame than would be possible with full disk encryption.

Evasion of Detection Systems

Since LockFile, several other threat actors have adopted intermittent encryption.

This technique provides a chance for threat actors to evade detection mechanisms that rely on monitoring the volume of data being written onto the disk. Cyberark has identified that BlackCat malware has been programmed with six distinct encryption modes.

It can do full file encryption or encrypt just the head of the file. The BlackCat software has the capability of breaking files into uniform segments and applying encryption to the initial bytes of each segment, or alternatively, utilizing distinct encryption methods based on the file's size and format.

Blurred Lines Between Corruption and Unusability

Intermittent encryption blurs the line between corrupting files and making files truly unusable. The utilization of intermittent encryption introduces ambiguity in identifying between file corruption and rendering files completely inoperable. Similar to the availability of various data recovery tools for corrupted files, there are tools such as White Phoenix that can facilitate data recovery from intermittently encrypted files.

Future Implications

The development of White Phoenix and similar tools could have significant implications for the future of ransomware attacks. By providing a free solution to recover data from partially encrypted files, researchers are empowering ransomware victims, potentially reducing the leverage that cybercriminals have over their targets.

Limitations and Challenges

While White Phoenix is a promising development, it is essential to remember that it only works on specific types of ransomware and file formats. Cybercriminals are continually adapting their tactics, and new forms of ransomware may emerge that cannot be decrypted using tools like White Phoenix.

Additionally, White Phoenix may not always be successful in recovering data if the encryption is too extensive or there are no salvageable parts available.

Conclusion

The release of White Phoenix marks a crucial step in the fight against ransomware attacks, particularly those involving intermittent encryption. Researchers are lessening the power of cybercriminals and giving impacted organizations much-needed relief by making a free tool available on GitHub that can help victims recover data from partially encrypted files.

However, challenges remain, and it is crucial for organizations to remain vigilant and proactive in their cybersecurity efforts. While tools like White Phoenix can provide assistance in the aftermath of an attack, prevention and early detection should remain the primary focus.