Regarding Sicarii's broken decryption process, researchers said that "during execution, the malware regenerates a new RSA key pair locally, uses the newly generated key material for encryption, and then discards the private key."
Vibe-Coded 'Sicarii' Ransomware Can't Be Decrypted
https://www.darkreading.com/endpoint-security/vibe-coded-sicarii-ransomware-decrypted
16 Comments
ElBarto@piefed.social · 145 pts · 203d
Ransomware that can't be decrypted is just destructive malware like any other.
SmoothLiquidation@lemmy.world · 91 pts · 203d
I bet other ransomware creators hate this. If victims can’t even get their data back by paying, more victims will stop paying across the board.
30p87@feddit.org · 110 pts · 203d
LMAO
Cevilia@lemmy.blahaj.zone · 77 pts · 203d
Natanael@infosec.pub · 13 pts · 202d
Well, unless they also made key generation shitty, because that's equally plausible and would likely allow RSA keys to be broken (it's surprisingly hard to generate RSA keys safely)
Cevilia@lemmy.blahaj.zone · 5 pts · 202d
DrunkAnRoot@sh.itjust.works · 40 pts · 202d
vibe coded and ranswomare in the same sentence was not on my 2026 bingo card
gustofwind@lemmy.world · 14 pts · 202d
we need a way bigger bingo card
MotoAsh@piefed.social · 40 pts · 203d
rofl of course...
DarkCloud@lemmy.world · 39 pts · 203d
Like a virus that kills the host, it won't spread as well and should die out faster than other types of maleware.
anton@lemmy.blahaj.zone · 35 pts · 203d
Did they vibe code their false identity as well?
OnfireNFS@lemmy.world · 14 pts · 203d
So they basically created a hashing function?
pivot_root@lemmy.world · 59 pts · 203d
A hash is at least consistent when given identical inputs. What they created is more like a digital incinerator.
Jayjader@jlai.lu · 8 pts · 202d
shred -f -uanton@lemmy.blahaj.zone · 7 pts · 202d
-uwould give you the space back.The ransomware doesn't. There is a block of data, sitting there, taunting you.
Jayjader@jlai.lu · 3 pts · 202d
ehehehehe thanks for that mental image
Of course, one can always reclaim that space if the data truly is inaccessible. Makes me want to write a joke program for "cleaning up" after ransomware that just removes the data from the partition table (or whatever the equivalent for files is - would that just be
rm?)NotMyOldRedditName@lemmy.world · 9 pts · 202d
Brilliant lol.
rain_worl@lemmy.world · 0 pts · 176d
"ransomware can't be decrypted" implies the ransomware itself can't be decrypted, ugh