American software firm Kaseya has access to the universal decryption key for the REvil ransomware that targeted its managed service provider customers.
The company announced its access to the decryption tool on Thursday, some 20 days after the ransomware attack took place on July 2
According to Kaseya, New Zealand-based security firm Emsisoft has confirmed the decryption tool does unlock files encrypted with REvil.
“We can confirm that Kaseya obtained the tool from a third party and have teams actively helping customers affected by the ransomware to restore their environments, with no reports of any problem or issues associated with the decryptor,” Kaseya said in a statement.
“Kaseya is working with Emsisoft to support our customer engagement efforts, and Emsisoft has confirmed the key is effective at unlocking victims.”
An unnamed customer last week claimed to have paid a ransom to the REvil gang but was unable to decrypt encrypted files with the decryption key provided. REvil sold its ransomware as a service to third-party criminal gangs.
The REvil gang’s websites went dark last week after US President Joe Biden pressed Russian President Vladmir Putin to clamp down on cybercriminals based in Russia that were targeting US firms.
Biden reportedly told Putin that critical infrastructure should be off limits after a separate ransomware attack from the group DarkSide knocked US east coast fuel distributor Colonial Pipeline offline.
Coop rolled out a mobile payment system to allow customers to pay for goods while it replaced encrypted cash registers on July 8. The mobile payment system was rolled out to 300 stores across Sweden, allowing it to continue in-store trade. It also worked with charities to distribute perishable items while its cash registers were down to minimize waste.
It’s not clear whether Kaseya paid the ransom demand of $70 million. A Kaseya spokesperson told The Guardian that it acquired the decryption key from a “trusted third party”.
While some of Kaseya’s downstream customers have remediated affected systems, some customers’ endpoints have remained offline and could restore systems with the decryption key.
