{"id":33466,"date":"2022-04-21T18:08:55","date_gmt":"2022-04-21T15:08:55","guid":{"rendered":"https:\/\/saudishopper.com.sa\/en\/?p=33466"},"modified":"2026-03-28T00:49:53","modified_gmt":"2026-03-27T21:49:53","slug":"kaspersky-experts-release-decryption-tool-for-yanluowang-ransomware","status":"publish","type":"post","link":"https:\/\/saudishopper.com.sa\/en\/kaspersky-experts-release-decryption-tool-for-yanluowang-ransomware\/","title":{"rendered":"Kaspersky experts release decryption tool for Yanluowang ransomware"},"content":{"rendered":"\n

The ransomware dubbed Yanluowang targets companies around the world, encrypting files on their computers and blocking access to their systems, so that victims cannot access their data. Previously, victims\u2019 only solution was to pay a ransom to the cybercriminals. However, after analyzing the ransomware, Kaspersky researchers have developed a free tool that allows victims to recover their affected files without using the attackers’ key. The tool is already available on the <\/strong>No Ransom<\/strong><\/a> website.<\/strong><\/p>\n\n\n\n

Yanlouwang was first discovered in October 2021. Its name is a reference to the Chinese deity, Yanluo Wang, one of the ten kings of hell. According to Kaspersky telemetry, Yanlouwang has been attacking large businesses in the United States, Turkey, Brazil and other countries. <\/p>\n\n\n\n

An attack using Yanluowang begins with an operator manually launching encryption. While encrypting the victims\u2019 files, this ransomware changes file extensions to \u201c.Yanlouwang.\u201d After attacking the computer, an open-access file is left with a ransom note. Cybercriminals threaten the victim that if they go to the police all files on the infected computer will be deleted. Even after deletion of all files, they will still not be left alone: Yanluowang’s authors threaten to then attack the entire company with DDoS attacks and ransomware infections on the company\u2019s employee computers. <\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

An example of a Yanluowang attack ransom note<\/em><\/p>\n\n\n\n

Kaspersky experts analyzed the ransomware and found a vulnerability that allows victims to decrypt files on an infected computer. The user needs to have one or more original files and download a specially designed decryption<\/a> tool. The victim is then able to decrypt the affected files independently.<\/p>\n\n\n\n

\u201c<\/em>While Yangluowang is not a widespread ransomware threat, it still hurts users and, in the fight against ransomware, every defeated malicious program counts. Ransomware is an international threat, and that is why it is important for the cyber community to cooperate in the fight against ransomware. We hope our contribution helps organizations attacked by Yanlouwang<\/em>,\u201d<\/em> comments Yanis Zinchenko, security researcher at Kaspersky.<\/p>\n\n\n\n

Read the full report about the Yanluowang on\u00a0Securelist<\/a>.<\/p>\n\n\n\n

To protect yourself from ransomware attacks, Kaspersky recommends you:<\/strong><\/p>\n\n\n\n