A way to decrypt data via has been discovered GPU, encrypted by the Akira ransomware
Cyber Security Specialist Tinyhack found a way decrypt filesencrypted by ransomware Akira, without paying a ransom. The method is based on encrypting codes using video cards, allowing affected companies to recover data.
Virus Akira, first discovered in 2023 year, attacks large organizations, demanding for data recovery millions of dollars. In the past, specialists Avast found a vulnerability in the encryption algorithm and released a tool to crack it, but soon the virus developers updated the protection. Now Tinyhack discovered a new method - it uses video cards to pick up keys and regain access to files.
Encryption in Akira based on timestamps recorded in nanoseconds. The brute force method allows you to determine exactly when the file was encrypted and, based on this data, restore the keys. Using NVIDIA RTX 4090, you can decrypt files in about 7 daysAnd with 16 video cards - behind 10 hours.
For the method to work, the encrypted files must not be modified after the attack. If the data is stored in Network Attached Storage (NFS), decryption becomes more difficult due to server latency, which makes it difficult to accurately determine the moment of encryption.
The method has already been successfully used to restore data from one of the attacked companies. Affected organizations are advised to rent powerful servers with video cards through runpod or vast.ai, to speed up the process. Complete recovery of virtual machines at one of the clients took 3 weeks.
Experts warn that attackers will likely update the protection, as happened after the release of the tool AvastHowever, companies that have already been attacked can use this method to get their files back without paying a ransom.
