The researcher has published the full source code and methodology on GitHub, providing a potential lifeline for organizations affected by this specific ransomware strain active since late 2023. According to the researcher, the malware uses the current time in nanoseconds as a seed for its encryption process, making it theoretically vulnerable to brute-force attacks. “From my initial analysis, I observed the ransomware uses the current time in nanoseconds as a seed,” according to the researcher, Yohanes Nugroho. The researcher reverse-engineered the ransomware code and discovered it uses the Yarrow256 random number generator seeded with timestamp values. The public release of this methodology and source code ensures that affected organizations have an alternative to paying for ransomware. The full source code and technical details are available on GitHub for organizations that may have fallen victim to this specific Akira variant. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. The ransomware employs this function to generate keys for both KCipher2 and Chacha8 encryption algorithms.
This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 14 Mar 2025 08:00:06 +0000