MUDDYWATER'S DARKBIT RANSOMWARE CRACKED

Summary from the TLDR InfoSec newsletter

Cybersecurity firm Profero has cracked the Iranian-backed MuddyWater's DarkBit ransomware, allowing clients to recover their data without paying a ransom. Profero found that the key generation method that DarkBit uses is weak and can be brute-forced. It also discovered that VMDK files on ESXi servers are sparse, and much of the content that its clients needed could be recovered without needing to brute-force the decryption. Profero is not publicly releasing its decryptor but urges victims to contact them.