NoMoreRansom Header

BleepingComputer is humbled and honored to announce that we have joined No More Ransom project as an associate partner! We have been providing ransomware information, support, and the amazing decryptors from Michael Gillespie since the beginning and this partnership will enable more victims to receive the help they need.

No More Ransom project is a joint project created by EuropolPolitie, and McAfeee to provide information and assistance to those affected by Ransomware. Since its creation, numerous other law enforcement agencies, security companies, and supporters have joined the project, which now supports 35 different languages with over 59 free decryption tools for 91 ransomware families.

How BleepingComputer first got started with ransomware

To give you a bit of a background on how BleepingComputer first got started writing about and supporting the victims of ransomware, it all goes back to 2012 when the first widespread ransomware called ACCDFISA was released.

While the initial versions had a static key that could be extracted from the malware executables, as we started helping more victims the developer increasingly created more complex versions. Thankfully, Fabian Wosar of Emsisoft came along and was able to continue to assist victims in recovering their files.

To our surprise, the ACCDFISA developer decided to come to BleepingComputer and post in our forums to taunt Fabian and the victims.

ACCDFISA developer at BC forums
ACCDFISA developer at BC forums
(Click to enlarge)

Then in 2013, CryptoLocker came and it took the computer security world by storm as massive malspam campaigns started pushing the ransomware installer. It wasn't until I made the connection that Zbot was distributing CryptoLocker and wrote about did I realize how much the ransomware developers were paying attention to what we were writing about.

Right after the article was published, we received a massive DDoS attack that took us offline for a couple of days. While this was not fun to deal with, it told us how much of an impact we were having and only strengthened our resolve to continue helping ransomware victims.

As ransomware grew, BleepingComputer began publishing our weekly "Week in Ransomware" articles and started working with independent security researchers and those from security companies such as Emsisoft, Kaspersky, Intel, McAfee, ESET, Malwarebytes, Avast, GData, and many more in a common goal to help victims stay informed and receive help. 

It wasn't until TeslaCrypt, though, that I saw the amazing community built at BleepingComputer really came together. Utilizing  BloodDolly's tool TeslaDecoder, members of our community volunteered their time and CPU cycles in a 148 page forum topic devoted to factoring hundreds, if not thousands, of victim's decryption keys so that they could get their files back for free. 

While striving to do what we could to help ransomware victims, BleepingComputer also became a regular stomping grounds for the ransomware devs to come and talk to the researchers or taunt their victims. 

Ransomware dev taunting victims
Ransomware dev taunting victims

Ransomware developers also started to come to BleepingComputer to release their master decryption keys when they abandoned their ransomware or switched to a new variant. The release of these keys have enabled the creation of numerous decryptors for Crysis, AES-NI, XData, DXXD, Dharma, and more. 

Master key for Dharma released on BleepingComputer
Master key for Dharma released on BleepingComputer
(Click to enlarge)

While ransomware has slowly switched from malspam campaigns to more directed attacks, this type of infection is still a major problems for its victims.

With that said, we will continue to help ransomware victims in need and look forward to working with No More Ransom and its partners until this threat no longer exists!